Security
Security posture for district review
This page summarizes how Schoolhouse is hosted, secured, and operated, written for district IT and security reviewers. The short version: curriculum use collects no student personal information, and the one optional student submission is a grades 9–12 week-1 log, so the attack surface a division has to evaluate is small by design.
Data footprint — no student PII from curriculum use
Curriculum use does not collect, store, or process student personal information. Curriculum is delivered as web pages and downloadable teacher editions; it does not require student accounts, logins, or rosters. We hold teacher/staff work email and name — and only when a division activates a license or someone requests access. The only student data we hold is an optional week-1 log a grades 9–12 student may send from the college-tracks page: email, grade, track, the free-text log, and the second reader’s name, kept no more than 12 months. This keeps the data a reviewer must assess limited to adult contact records and those optional logs.
Hosting & encryption
Schoolhouse is hosted on Vercel (CDN and serverless functions in the United States), with application data stored in Supabase (PostgreSQL, United States; region configurable). All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Our infrastructure providers maintain SOC 2 Type II certifications.
Access controls
We follow least-privilege access internally and enforce row-level security (RLS) on database tables. All public API endpoints validate and length-bound their inputs before any data is written. Gated downloads require an active organizational entitlement — anonymous users cannot reach licensed artifacts, and the entitlement check runs only in trusted server code.
Sub-processors
We use a small set of US-based, SOC 2-certified service providers. We do not sell data or use it for advertising. Student personal information reaches them only when a student chooses to send a week-1 log.
| Provider | Purpose | Region | Compliance |
|---|---|---|---|
| Vercel | Web hosting, CDN, serverless API routes | United States | SOC 2 Type II |
| Supabase | PostgreSQL database (lead/contact forms, licensed-org records) | United States (configurable region) | SOC 2 Type II |
| Resend | Transactional and inbound email (confirmations, access notices, week-1 log notifications) | United States | SOC 2 |
| Slack | Staff notification of new submissions (includes week-1 log text) | United States | SOC 2 Type II |
| Cloudflare | Turnstile spam check on public forms (IP address) | United States | SOC 2 Type II |
| Upstash | Rate limiting on public forms (IP and email as short-lived keys) | United States | SOC 2 |
| Web font CDN (fonts.googleapis.com); IP may be logged, no student data | United States | SOC 2 / ISO 27001 |
Incident response
In the event of a security incident affecting personal information we hold, we will notify affected divisions and individuals without unreasonable delay, and no later than 30 calendar days after we determine that a breach occurred, or sooner where your DPA or state law requires it.
Compliance & certifications
Our infrastructure providers are SOC 2 Type II certified. Schoolhouse itself does not yet hold an independent SOC 2 report; given our low-data-footprint architecture (no student PII from curriculum use), most division IT reviews are satisfied by the controls above plus our signed DPA. We are happy to complete your division’s security questionnaire or VPAT/ACR request.
For data-handling specifics, FERPA/COPPA architecture, and our SDPC NDPA readiness, see the privacy policy and DPA procurement pack.
Security contact
Security questionnaires, penetration-test attestations, or questions about this page:
privacy@contact.schoolhouse.space
Schoolhouse · Virginia, USA
Related: Privacy & data policy · DPA procurement pack · Accessibility