Privacy notice
Last updated 10 October 2026
AttestIn keeps a record of the work students do — jobs, volunteering, shadowing — confirmed by the people who supervised it. AttestIn is operated by Altriks. This notice says what we collect, why, who can see it, and how long we keep it.
If you received an email asking you to confirm someone’s experience
A student entered your email address as their supervisor or reference. That is the only way we got it. If you don’t know them, ignore the email: nothing happens unless you respond, and the request expires after 21 days. We send at most two reminders.
If you answer, we record whether you confirmed or declined, the reason you chose if you declined, the facts you were shown, the time, and the network address (IP) and browser (user agent) you used. You never need an account.
What we collect
- Students: email address and name; the experiences they record (organization, role, dates, hours, notes); the people they ask for an attestation (name, job title, email address, relationship).
- Supervisors who answer: the answer, as described above.
- People who open a shared record: each view is recorded with the time, a shortened network address and the browser, so the student can see how often their link was used.
- Everyone: sign-in sessions, a log of actions taken in AttestIn, and whether our emails were delivered, bounced or marked as spam.
Who can see it
- The student sees their own record, including who confirmed or declined.
- An employer or program office sees a student’s confirmed experiences only when the student shares a link with them. The link expires, and the student can revoke it at any time. It never shows a supervisor’s email address or phone number.
- AttestIn administrators review organizations and can read the action log, to keep the registry honest and to investigate misuse.
- We don’t sell personal information, and we don’t show advertising.
Services we use
- Railway hosts the application and its database in the United States.
- Postmark sends our email. Open and click tracking are turned off.
- Sentry receives error reports, with personal details removed; it doesn’t store IP addresses.
How long we keep it
- Sign-in codes expire after 10 minutes. Sign-in sessions last up to 30 days.
- Records — experiences, requests, answers and the action log — are kept, because a confirmation is only worth something if it can’t quietly disappear.
- Database backups are kept for up to about three months.
Deactivation, not deletion
A student can deactivate any experience, or their whole record, from their account. A deactivated experience disappears from their record, their reports and every share link, and any open attestation request is withdrawn. It is not erased: AttestIn’s policy is to keep what a supervisor confirmed, so that nobody can make an unfavourable record disappear. This is our policy; it has not yet been reviewed by a lawyer.
Emails we send
Sign-in codes, attestation requests and their reminders, and updates about your own requests. Students may also get a weekly reminder about experiences that still need an attestation; every one has a link to turn it off.
Questions
Email info@altriks.com with any question about your information, or to report misuse.