Security
Security posture for district review
This page summarizes how Schoolhouse is hosted, secured, and operated, written for district IT and security reviewers. The short version: we collect no student personal information, so the attack surface a division has to evaluate is small by design.
Data footprint — no student PII
Schoolhouse does not collect, store, or process student personal information. Curriculum is delivered as web pages and downloadable teacher editions; it does not require student accounts, logins, or rosters. The only personal data we hold is teacher/staff work email and name — and only when a division activates a license or someone requests access. This keeps the data a reviewer must assess limited to adult contact records.
Hosting & encryption
Schoolhouse is hosted on Vercel (CDN and serverless functions in the United States), with application data stored in Supabase (PostgreSQL, United States; region configurable). All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Our infrastructure providers maintain SOC 2 Type II certifications.
Access controls
We follow least-privilege access internally and enforce row-level security (RLS) on database tables. All public API endpoints validate and length-bound their inputs before any data is written. Gated downloads require an active organizational entitlement — anonymous users cannot reach licensed artifacts, and the entitlement check runs only in trusted server code.
Sub-processors
We use a small set of US-based, SOC 2-certified service providers. We do not sell data or use it for advertising, and no sub-processor receives student personal information.
| Provider | Purpose | Region | Compliance |
|---|---|---|---|
| Vercel | Web hosting, CDN, serverless API routes | United States | SOC 2 Type II |
| Supabase | PostgreSQL database (lead/contact forms, licensed-org records) | United States (configurable region) | SOC 2 Type II |
| Resend | Transactional email (confirmations, access notices) | United States | SOC 2 |
Incident response
In the event of a security incident affecting personal information we hold, we will notify affected divisions and individuals without unreasonable delay, consistent with applicable law and your DPA terms.
Compliance & certifications
Our infrastructure providers are SOC 2 Type II certified. Schoolhouse itself does not yet hold an independent SOC 2 report; given our low-data-footprint architecture (no student PII), most division IT reviews are satisfied by the controls above plus our signed DPA. We are happy to complete your division’s security questionnaire or VPAT/ACR request.
For data-handling specifics, FERPA/COPPA architecture, and our SDPC NDPA readiness, see the privacy policy and DPA procurement pack.
Security contact
Security questionnaires, penetration-test attestations, or questions about this page:
privacy@contact.schoolhouse.space
Schoolhouse · Virginia, USA
Related: Privacy & data policy · DPA procurement pack · Accessibility