Security & Privacy

Your students' data.
Sacred. Protected. Yours.

Industry-standard encryption, strict compliance, and a privacy-first architecture — because student records deserve the same care as the education itself.

How we protect your data

Six layers of security.

אEncryption

Data encryption

All data encrypted in transit with HTTPS/TLS and at rest with AES-256. Access tokens encrypted at the application level.

בAccess

Role-based access

Granular permissions so teachers, parents, and students only see what they need. Multi-school data separation built in.

גStorage

Secure storage

Encrypted backups with point-in-time recovery. Regular security audits. Data stored in SOC 2 Type II certified infrastructure.

דAuth

Authentication

Bcrypt password hashing, session management, optional MFA, and audit logs on sensitive actions. No shortcuts.

הMonitoring

24/7 monitoring

Automated threat detection, DDoS protection, and incident response procedures. We watch so you don’t have to.

וPayments

Secure payments

Stripe-powered (PCI DSS Level 1). Card numbers never touch our servers. Tokenized for recurring billing.

Security signals

Controls you can actually verify.

Encryption, role isolation, audit trails on sensitive actions, and export-on-demand — every claim has a concrete control behind it, not a promise.

256-bit

At rest & in transit

AES-256 / TLS

Data sold

Ever

SOC 2

Infra certified

Via Supabase

100%

School-owned

Export anytime

Access

Per-role data isolation

RLS at the database level — a teacher can’t read another school’s talmidim, and core academic records are scoped to their own classes.

Audit

Audit trail on sensitive actions

Grade changes, role changes, impersonation, and data exports are recorded — who, what, when, from where — in an append-only log. FERPA disclosure logging on exports.

Export

Export & deletion on demand

Built-in roster, health, and attendance exports (CSV / JSON). Full data export and family-side deletion honored on request within 10 business days.

Comms

Comms stay on school numbers

SMS through the school’s Twilio line, not personal cell phones. Logs in the school inbox.

Read the privacy policy Contact the security team

Compliance

We meet the
highest bars.

Student privacy isn't a feature — it's the foundation. Every decision we make starts with the question: does this protect the student?

FERPAStudent educational records

We are designated as a School Official with a legitimate educational interest. Role-based access ensures only assigned teachers and authorized admins can view student records. Parents use a separate secure portal. Schools maintain full data ownership with export capabilities.

COPPAChildren under 13

GDPREuropean data privacy

SOC 2Infrastructure certification

Privacy by design

Six principles we
don't compromise on.

Minimal collectionWe collect only what is necessary for educational purposes. No behavioral profiling. No ad tracking.

School ownershipSchools own 100% of their data. Built-in exports plus full data export on request. Delete on request within 10 business days.

No selling. Ever.Student data is never sold, rented, or shared with advertisers. Period.

Transparent practicesClear privacy policies. Append-only audit logs on sensitive actions and exports. Parents can review their child’s data at any time.

Parent controlParents can review records, request corrections, and control communication preferences through their portal.

Retention limitsActive data retained while the school is active. Archived 60 days after termination, then permanently deleted.

דַּע מַה לְּמַעְלָה מִמְּךָ — עַיִן רוֹאָה וְאֹזֶן שׁוֹמַעַת וְכָל מַעֲשֶׂיךָ בַּסֵּפֶר נִכְתָּבִין

“Know what is above you: a seeing eye, a hearing ear, and all your deeds are recorded in a book”

Pirkei Avot 2:1

We built Chinuch App for Jewish schools. That means we understand the weight of the trust you place in us. Student records, family information, educational progress — we treat every byte as sacred.