Trust & compliance

Security and compliance trust center.

Transparent security posture, compliance alignment, and audit-ready controls for schools and regulators.

Request security packet Procurement checklist →

The trust documents

One page per subject. Each one says what the product does, and says plainly what it does not yet state.

  1. 1

    FERPA & student records

    The school is the custodian. How access, disclosures, and corrections are handled.

  2. 2

    COPPA & under-13 accounts

    The account gate, consent records, and why a child cannot self-register.

  3. 3

    GDPR & UK GDPR

    Roles, data subject requests, and who may approve what.

  4. 4

    Retention schedules

    Who sets a period, and why nothing is deleted before it is archived.

  5. 5

    Incident response

    Detection and how the customer's security contact is told.

  6. 6

    Accessibility (WCAG)

    The target, what is built in, and how to report a barrier.

  7. 7

    Platform security

    The behaviors the product enforces, for a security review.

Certifications and attestations

We never imply SOC 2, PCI, or live payment settlement until externally verified and published for your deployment.

  • Not published

    SOC 2 Type II

    Control design documented; external attestation not published

  • Not published

    ISO 27001

    Control design documented; external attestation not published

  • Not published

    PCI DSS attestation

    Control design documented; external attestation not published

  • Not published

    Live PSP settlement

    Control design documented; external attestation not published

Availability posture

RunMyCampus targets 99.9% platform availability. Planned maintenance is communicated in advance.

Target: 99.9% — 24/7 operator readiness for critical issues. Support and governance from manager workflows.

Shared responsibility

  • This deployment is the online profile. The hosted application is what this page describes.
  • RunMyCampus operates the application, the hosted database, and the access controls on the platform. The school operates its accounts, its devices, and the appliance when the school runs one.
  • The region configured for this deployment is not published on this page.
  • A school asks for its data from the trust center. A person replies. This page does not start a download.
  • No certification mark is shown here. A certification is listed only once it is externally verified.