Security and data

Alta Council is built for leadership decisions, not for student data. Advisors reason about enrollment counts, budgets, staffing, and strategy. None of that requires a single student’s name.

Please do not enter personally identifiable student information, individual student records, or anything covered by FERPA. The product does not need it, and Alta Council is not offered as a school official under FERPA or as a party to a student data privacy agreement.

This applies with particular force to the notes you type during a session, because those are the notes a durable fact can be filed from and kept.

Every account belongs to a school, and every query for a session, a message, or a school profile is scoped to that school before it runs. There is no shared view and no cross-school search.

This is the one property that must never regress, so it is tested rather than trusted. An automated check creates two schools, writes a session to each, asserts that every cross-school read comes back empty, and deletes its own fixtures. It runs before changes ship.

When you use Alta Council, the database holds:

• Your name, email address, and a hashed password. Passwords are hashed with bcrypt and never stored in readable form.
• Your school profile: school name, state, model, grade span, enrollment, and the optional context you choose to add, such as months of cash on hand or renewal date.
• Your sessions: the question you asked, the notes you typed during the session, what each advisor replied, and the record you closed with.
• The facts about your school that you confirmed. What these are and how they get there is a later section.
• What you file in Sources: the text of documents you upload (Word, Excel, PDF, text, Markdown, or CSV; Alta keeps the text, not the file), the notes you paste, with who sent them and when, and the figures you type in by name. Each document records who added it, who may read it, when Alta read it, and the period it describes. What Alta proposes from each one is stored beside it, marked as proposed until you keep or reject it.
• Your priorities, obligations, decisions, and commitments, with their sources, owners, dates, and verification status; the drafts Alta prepares and the versions you edit; each Monday briefing and Friday wrap-up as it was built; and the approval ledger, which records who approved each consequential action, when, and exactly what.
• The people you record: name, organization, responsibility, and an email address if you give one. A person recorded this way has no account and receives nothing from Alta.
• Any figures Alta imported from an authorizer’s public record before October 2026, with their source and date. Alta no longer reads the public record.
• A log of account activity such as sign-ins and password changes, and a log of each call to the AI provider: which model, how many tokens, how long, and whether it failed. Never the text of the call.

Signing in sets one cookie. It is HTTP-only, sent only over HTTPS, restricted to this site, and expires after thirty days.

While you are writing the record of a session, the unsaved draft is held in your browser tab so that a reload does not lose it. It stays on your device, is never sent anywhere until you press save, and is discarded when you save or when you close the tab.

Alta keeps a short list of durable facts about your school: the kind of thing no advisor could know and you should not have to retype. That the business manager leaves in March. That the county will not move on facilities until the legislative session ends. Those facts are put in front of every advisor in your later sessions.

The rules it works under, which are enforced in the code:

• A fact enters the list only when you confirm it. You type it in Sources, or you keep one Alta proposed from a note, a document, or a session. Alta files none on its own.
• When you close a session, Alta reads the notes you typed in it and proposes up to three facts. Each waits on the session until you press Keep or Discard, and a discarded one is never filed. It proposes only things you said, not what the advisors concluded.
• Alta is instructed never to propose a fact about a named student.
• Every fact carries where it came from and when it was true, and both are shown to you and to the advisors. Nothing is presented as more certain than its source.
• Nothing is overwritten. A newer value supersedes an older one, so the record of what you believed in March survives.

You can see everything filed about your school on the council page, and remove any of it in one click. A removed fact stops being shown to you and stops being sent to any advisor. The row itself is marked removed rather than erased, and goes when the account does.

Your closed decision records travel the same way: when you bring a related question later, the records of decisions you already made are put in front of the advisors, so the council can be consistent with what your school has already committed to.

Two kinds of message leave Alta Council, and each is governed by a rule enforced in the code rather than in a prompt.

• Account mail to you: sign-in links, password resets, and a confirmation when you apply for the pilot.
• Your Monday briefing and Friday wrap-up, only after you have authorized email delivery on the Delivery page, on the days and at the times you set, once per edition. Every link in them opens Alta signed in; opening a link never approves, sends, or changes anything.

Nothing else leaves. Alta sends no message on your behalf: a follow-up it drafts is yours to send from your own mail. It does not send to your board, your provider, or anyone else, and it has no standing permission to act without you.

Four companies, each for one job. No data is sold, and none is shared with anyone else.

Advisor responses are generated through Anthropic’s API. Anthropic states that it does not train its models on inputs or outputs sent through that API. Alta Council does not train any model of its own on your sessions, and does not use one school’s sessions to answer another school’s questions.

This site runs no analytics, no advertising pixels, and no third-party tracking scripts of any kind. Nobody is following you around the internet on our account. The hosting provider keeps ordinary server logs, as every host does.

Your sessions are kept for as long as your account is open, because the written record months later is the point of the product.

Your records, briefs, and the approval ledger are kept for as long as your account is open, for the same reason. A commitment or a decision you change keeps its history; nothing is overwritten.

A document you remove from Sources leaves new work, Today, and search at once, and drafts already written from it keep their own copy. Its stored text stays with your records until the account is deleted.

Facts filed about your school are kept until you remove them or the account is deleted. There is no automatic expiry: a fact from a year ago is still shown to the advisors, marked as a year old, rather than quietly dropped. You decide what is no longer true.

There is no automated deletion schedule today. If you want your account and everything in it removed, write to martez@altacouncil.com and it will be deleted within thirty days. You can ask for a copy of your sessions at any time.

Alta Council is a new, founder-led product. It has no SOC 2 report, no ISO certification, and no third-party penetration test. If your district or authorizer requires any of those before you can use a vendor, it does not have them yet, and you should say so rather than find out later.

Nobody has measured the time Alta saves, and we will not state a number until pilot schools do.

Three things are not yet on:

• Reading your Google Calendar, Drive files, and email. Each is built as its own read-only choice, and all three stay off until we complete Google’s review.
• Scanned PDFs. Alta reads Word, Excel (.xlsx), PDF, text, and CSV files that contain text. Paste the text of a scan, and save an older spreadsheet as .xlsx first. Alta reads the result Excel stored for a formula; it does not run one.
• Standing permissions. They are designed, not yet on: nothing runs without you.

If you find a security problem, write to martez@altacouncil.com. You will get a reply from the founder, not a ticketing system.

See also the privacy policy and the terms of service.