Redaction before storage
Student names are stripped from every transcript before it touches our database. Both intake paths — pasted transcripts and AssemblyAI webhooks — call the same redaction step, and it's fail-closed: if redaction errors, we discard the transcript rather than store an unredacted copy.