Security & compliance
Security and compliance built into daily operations.
Protect tenant data with auditability, policy controls, and region-aware compliance defaults.
Regime by regime
| Regime | What the platform provides | Read |
|---|---|---|
| FERPA | School-controlled access, a disclosure record, and reviewed correction requests. | FERPA page → |
| COPPA | An account gate for learners under the configured age, and consent records that are hashed when signed. | COPPA page → |
| GDPR | A request workflow for erasure, export, and correction, with separation of duties. | GDPR page → |
| Retention | Configurable periods, archive before purge, and a report before any deletion. | Retention page → |
| WCAG 2.2 | A target of AA, with automated checks. Not a conformance claim. | Accessibility page → |
Certifications and attestations
We never imply SOC 2, PCI, or live payment settlement until externally verified and published for your deployment.
-
Not published
SOC 2 Type II
Control design documented; external attestation not published
-
Not published
ISO 27001
Control design documented; external attestation not published
-
Not published
PCI DSS attestation
Control design documented; external attestation not published
-
Not published
Live PSP settlement
Control design documented; external attestation not published
Built into daily operations
- 01
Tenant-scoped controls
Data access, policy settings, and activity traces stay scoped to each school.
- 02
Audit readiness
Operational events, support actions, and administrative changes remain reviewable.
- 03
Regional compliance posture
Map schools to compliance regions and align workflows to local obligations.