ConflateLAST UPDATED OCTOBER 30, 2026
How we keep your keys safe
To show your dashboard, Conflate holds a few keys on your behalf: your Canvas access token, your calendar links (Outlook, Google or both) and, if you use it, your Microsoft sign-in. Here’s exactly how they’re protected, and what you can do yourself.
Encrypted before they’re saved
Your keys are encrypted the moment they reach our server, before anything is written to the database. We use Fernet, a widely used standard that combines AES encryption with an HMAC signature, so a stored key can’t be read, and can’t be changed without it being detected.
The encryption key is a long random secret that lives only in the server’s private settings. It isn’t stored in the database or in Conflate’s code. A copy of the database on its own, such as a stolen backup, contains only scrambled values.
| What | How it’s stored |
|---|---|
| Canvas token and Canvas address | Encrypted |
| Calendar links | Encrypted |
| Microsoft sign-in | Encrypted |
| Sign-in sessions | Only a one-way hash, which can’t be turned back into your session |
| Emailed codes | Only a keyed hash, and they expire after 10 minutes |
| Passwords | Never stored. Only a salted scrypt hash, which is slow and memory-hungry to work out on purpose |
Never sent back to your browser
Once saved, a key never leaves the server again. Settings only shows its last four characters, so you can tell which one is connected. Keys are decrypted on the server only at the moment they’re needed to make a request for you, and are never written to logs.
Sent only where they belong
- Your Canvas token goes only to your school’s Canvas address, and only over encrypted (https) connections. If Canvas redirects a request to a different website, the token is removed first, so it can’t be passed along.
- Your Microsoft sign-in goes only to Microsoft.
- Conflate refuses to connect to private or internal network addresses, so a crafted link can’t trick the server into sending a key somewhere it shouldn’t.
- Your keys are never shared with Anthropic or any other service. The homework estimates only see an assignment’s course, title and instructions.
Read-only by design
Conflate only reads from Canvas and your calendar. It never submits assignments, posts, or changes anything there.
Signing in
- Signing in takes two steps: your password, then an 8-digit code we email you. Someone who learns your password still can’t get in without your email.
- New accounts confirm their email address with a code before they’re made.
- Codes expire after 10 minutes, allow only a few tries, and work only in the browser that asked for them.
- Password attempts and code requests are limited, per email address and per network, to stop guessing.
- Resetting or changing your password signs you out on every other device.
- Your session cookie can’t be read by scripts, is sent only over https, and is tied to Conflate’s own address. Sessions end after 30 days, or as soon as you sign out.
- If someone keeps guessing your password, your account stops accepting passwords from browsers that have never signed in to it, while the browsers you use keep working. Sign-up and reset emails have their own small limits, so they can’t be used to stop you signing in.
- Conflate answers the same whether or not an email address has an account, so nobody can use it to find out who uses Conflate.
On the website
- Every page runs under a strict security policy: only Conflate’s own scripts can run, and pages can’t be embedded in other websites.
- Information that comes from Canvas, such as course names, is cleaned before it’s shown, so it can’t run code in your browser.
- There are no ads, analytics or tracking scripts.
Where it lives
Conflate runs on Render, a cloud hosting provider. The database sits on a private disk attached to the server and isn’t reachable from the internet, and its file can only be read by the server itself.
An honest limit. To fetch your classes, the server has to be able to decrypt your token while it’s running. Encryption protects your keys if the database is copied or stolen, but not against someone who takes over the running server itself. That’s true of any service that connects to your accounts for you, which is why the steps below are worth taking.
What you can do
- Give your Canvas token an expiry date when you create it. Settings shows how many days it has left.
- Remove a connection any time with “Remove” in Settings. The saved key is deleted.
- Revoke your token in Canvas (Account → Settings → Approved Integrations) if you ever think it’s been exposed. That stops it working everywhere, immediately.
- Keep your email account secure, since that’s how you sign in to Conflate.
Report a problem
If you think you’ve found a security issue, please email wall.jak@northeastern.edu. We’ll look into it right away. More about how we handle your information is in our Privacy Policy.