Every statement on this page describes behaviour you can verify in a demo. Where we have not built something, it says so.
Most of what matters is not a policy. It is what the software does on an ordinary Tuesday.
A push notification never puts a student name, a grade, a health note or a balance on a lock screen. The alert carries an identifier and the app fetches the content over an authenticated connection once the phone is unlocked. A phone face up on a kitchen table says nothing about your child.
Every retained upload is checked and scanned by an antivirus engine before anyone can open it. Anything that fails is quarantined where it cannot be served or run. Enrollment documents stay locked to staff until the scan comes back clean.
Files are stored outside the website directory entirely and served only through an authenticated request that checks who is asking. There is no URL to guess and no folder to browse.
A parent sees a child only through a recorded guardian link. Joining a parent conference is allowed for their own booked slot, their own child, within a short window either side of the appointment.
A single rule decides whether a member of staff may open a student record, and it is the same rule in every module. Teachers see their roster, the sections they co-teach, and students whose plans name them as case manager. Nurses, counselors and special education staff are school wide because their jobs are.
Administrative actions and field level edits are written to an audit trail with who, what and when. Enrollment approvals record the exact diff that was applied to the student record.
There is no recording feature. That means there is no classroom video to retain, redact, hand over in response to a records request, or lose.
Meetings are peer to peer, so classroom video travels device to device. We could not produce a copy if we were asked, because we never have one.
There is no meeting link to distribute and nothing to forward. An administrator can see a meeting exists but must knock to enter, even on a locked room, and the teacher decides.
A host can switch a student camera off. No one can switch one on remotely.
A student removed from a meeting returns to the waiting room rather than being locked out, so a misclick during a lesson is not a crisis.
Whiteboard strokes carry the account that made them, in a colour assigned rather than chosen. Clearing the board records the clear instead of destroying what was there.
Student data is not sold, not mined, and not used to target advertising. There is no advertising anywhere in the product.
Each district runs in its own database, with every school inside it kept apart by a school check on every query, and its own encryption key for confidential documents. Configuration secrets are encrypted at rest on the server and are not kept in source control.
Roster, enrollment, section, attendance and related datasets export as standard CSV whenever you want them. We do not charge for an export and we do not require notice.
Passwords are never stored in a readable form and cannot be retrieved by us or shown back to anyone, including support. Repeated failed sign ins are throttled, and a failed attempt does not reveal whether the account exists. Sessions and API access can be revoked centrally, and API access is limited to what each integration needs.
Google or Microsoft accounts, so staff and students keep the login they already have and your existing offboarding process still works.
If you go, you go with your data. We would rather lose a district cleanly than hold one hostage.
A page about security that only lists strengths is a sales page. These are real gaps today.
We have not completed one and we will not imply otherwise. If a VPAT is a procurement requirement, tell us early and we will be straight with you about timing.
The platform cannot send email or text messages. Families are reached through the parent portal and app notifications. Where the product says it notified a parent, it means it recorded the contact.
Fees, lunch money and fundraiser payments go through the school's own Stripe account, connected by the school. The school is the merchant of record; we never hold, route or see your funds, and we have no card numbers to lose.
Michigan MSDS is built as a screen with its own checks. For every other state we produce clean, complete CSV datasets that are not yet mapped to that state's submission layout, so a person still does the final step. Tell us your state on the first call.
Video runs device to device today, which keeps it private and free to run. Larger rooms through a media server are on our roadmap, and we have the capacity ready to turn on as demand calls for it. It will not change what a school pays.
The family app and the core family pages on the web read in English and Spanish. Staff and office screens are English; a Spanish-speaking teacher works in English today.
This page describes what the product does, not how it is built. Districts whose procurement asks for implementation detail - hashing scheme, session handling, key management, retention, sub processors - should ask us for the security questionnaire response, which we send directly rather than publish. A public page is the wrong place for a map of the building.
If any of these is a blocker for your district, say so on the first call rather than the fifth. We would rather lose the deal early than waste your year.