Security
Security posture for district review
This page summarizes how Schoolhouse is hosted, secured, and operated, written for district IT and security reviewers. The short version: curriculum use collects no student personal information, and the one optional student submission is a grades 9–12 week-1 log, so the attack surface a division has to evaluate is small by design.
Data footprint — no student PII from curriculum use
Curriculum use does not collect, store, or process student personal information. Curriculum is delivered as web pages and downloadable teacher editions; it does not require student accounts, logins, or rosters. We hold teacher/staff work email and name — and only when a division activates a license or someone requests access. The only student data we hold is an optional week-1 log a grades 9–12 student may send from the college-tracks page: email, grade, track, the free-text log, and the second reader’s name, kept no more than 12 months. This keeps the data a reviewer must assess limited to adult contact records and those optional logs.
Hosting & encryption
Schoolhouse is hosted on Vercel (CDN and serverless functions in the United States), with application data stored in Supabase (PostgreSQL, United States; region configurable). All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Our infrastructure providers maintain SOC 2 Type II certifications.
Access controls
We follow least-privilege access internally and enforce row-level security (RLS) on database tables. All public API endpoints validate and length-bound their inputs before any data is written. Gated downloads require an active organizational entitlement — anonymous users cannot reach licensed artifacts, and the entitlement check runs only in trusted server code.
Sub-processors
We use a small set of service providers. This is the same list as the privacy policy. A certification appears only when that provider’s public trust or compliance page states it. We do not sell data or use it for advertising. Student personal information reaches them only when a student chooses to send a week-1 log.
| Provider | Purpose | Data categories | Region | Certification |
|---|---|---|---|---|
| Vercel | Web hosting, CDN, serverless API routes | Server logs (IP address, user agent, requested URL). No student data from curriculum use. | United States | SOC 2 Type II |
| Supabase | PostgreSQL database (lead and contact forms, licensed-org records, student week-1 logs) | Lead and contact form submissions, licensed-organization records, and student week-1 logs | United States (configurable region) | SOC 2 Type II |
| Resend | Transactional and inbound email (confirmations, access notices, week-1 log notifications) | Email addresses and message content for confirmations, access notices, and week-1 log notifications | United States | SOC 2 Type II |
| Slack | Staff notification of new submissions (includes week-1 log text) | Submission contents, including week-1 log text | United States | SOC 2 Type II |
| Cloudflare Turnstile | Bot verification on public forms | IP address | United States | SOC 2 Type II |
| Upstash | Rate limiting for public form submissions (IP and email as short-lived keys) | IP address and email as short-lived keys | Not confirmed | SOC 2 Type II |
| Web font CDN (fonts.googleapis.com); IP may be logged, no student data | IP address. No student data. | United States | Not published |
Incident response
In the event of a security incident affecting personal information we hold, we will notify affected divisions and individuals without unreasonable delay, and no later than 30 calendar days after we determine that a breach occurred, or sooner where your DPA or state law requires it.
Compliance & certifications
Vercel and Supabase publish SOC 2 Type II attestations. The table above is the full certification list. Schoolhouse itself does not yet hold an independent SOC 2 report; given our low-data-footprint architecture (no student PII from curriculum use), most division IT reviews are satisfied by the controls above plus our signed DPA. We are happy to complete your division’s security questionnaire or VPAT/ACR request.
For data-handling specifics, FERPA/COPPA architecture, and our SDPC NDPA readiness, see the privacy policy and DPA procurement pack.
Security contact
Security questionnaires, penetration-test attestations, or questions about this page go through the contact form.
Data-protection, DPA, and deletion requests: privacy@contact.schoolhouse.space
Schoolhouse · Virginia, USA
Related: Privacy & data policy · DPA procurement pack · Accessibility