Security & Trust

Security contact

Our named security contact is Devin Farren, co-founder. Reports to security@surestepeducation.com reach a founder directly and are acknowledged within one business day. If you believe you've found a vulnerability in our site or products, tell us — we will thank you, not lawyer you.

The CA-NDPA: we bring it to you

California law (Ed. Code §49073.1) requires districts to have a student-data privacy agreement with any vendor that touches student records. We don't make you chase us for it: we proactively offer the California Student Data Privacy Agreement (CSDPA/NDPA) to every district we work with, signature-ready. It converts everything on this page from promises into contract terms — US data residency, no selling or mining of student data, breach notification timelines, and deletion on demand.

Email us and we'll send the agreement the same week — no sales call required.

Questions your tech director will ask

The short answers, up front. Every one of them links to the section — here or in the privacy policy — where the full commitment lives.

Where does student data live?

In a Supabase (AWS) database in the United States — one database, one region, encrypted in transit (TLS 1.2+) and at rest (AES-256). It never leaves the US. How data is protected →

Do you sell student data, advertise, or track students?

No, never — no sale of data, no targeted advertising, no profiling, as SOPIPA requires and our agreements guarantee. There are no analytics SDKs, ad networks, or tracking pixels in any product or on this site. Student data in our products →

Will you sign the CA-NDPA?

Yes — we offer it proactively, before we're asked. See above →

Are you FERPA compliant?

Yes. We operate as a "school official" under FERPA's exception: the district always owns and controls its records, we use them only to provide the contracted service, and we never re-disclose them. FERPA details →

Who are your subprocessors, and what audits do they hold?

Seven, listed publicly with what each one touches and its independent certifications — Supabase, Vercel, Cloudflare, and Anthropic all hold SOC 2 Type II reports. Only Supabase stores student data. Districts with signed agreements are notified before any new subprocessor handles student data. Full subprocessor table →

Do you use AI on student data?

No. AI (Anthropic's Claude) is used only to parse school-operations documents like bell schedules — never student records — and none of it is used to train AI models. Subprocessor details →

What happens if there's a breach?

Written notification to each affected district within 72 hours of determination, full cooperation with the district's own notification duties, a root-cause report within 30 days, and never a bill for our incident. The full commitment →

What happens to our data when the contract ends?

Your records are always yours: exportable in standard formats on request, and termination triggers certified return or deletion on your terms. For district-wide agreements we offer source-code escrow so an adopted tool can't vanish. Retention and deletion →

Who at Sure Step can see our data?

By default, nobody — the same database row-level security that binds district staff binds us. Maintenance access is an explicit, founder-only, reason-required, time-limited exception, logged where the district can see it. How we build →

Do you hold your own SOC 2?

Not yet, and we won't pretend otherwise. Student data lives exclusively in SOC 2 Type II-audited infrastructure, and what we add on top is small enough to actually inspect — we welcome district-led security reviews. The honest part →

Breach notification: our 72-hour commitment

If we determine that unauthorized acquisition, access, use, or disclosure of student records has occurred — or is reasonably believed to have occurred — we will:

• Notify each affected district in writing within 72 hours of determination, including what happened, which data elements and students were affected, when, and the containment steps already taken.
• Cooperate fully with the district's own notification obligations under Ed. Code §49073.1 and Civ. Code §1798.29/§1798.82, including supplying what the district needs to notify families — at our expense where the breach arose from our systems.
• Investigate and remediate: root-cause analysis and a written post-incident report to affected districts within 30 days.
• Follow the district's lead on family communication — districts control how their families hear about their students.
• Never charge a district for breach response arising from our or our subprocessors' systems.

How we build

• Access rules live in the database. Row-level security enforces who can see what — the interface is a convenience, not the boundary. A misbehaving client can't widen its own access.
• We can't casually read your data. In our student-record products, the same database rules that bind district staff bind us. Maintenance access is an explicit, founder-only, reason-required, time-limited exception — and it's logged where the district can see it.
• Encryption everywhere: TLS 1.2+ in transit, AES-256 at rest. Student data stays in the United States.
• Append-only audit trails in student-record products: record access, exports, configuration changes, and every privileged exception.
• No ads, no trackers, no analytics SDKs — on this site or in any product. There is nothing to audit because there is nothing there.
• Least-privilege keys and versioned changes: browsers only ever hold anonymous, database-restricted credentials; privileged keys exist only server-side; schema changes ship as numbered migrations, snapshot-first.

Our current subprocessors — and which of them touch student data — are listed in the privacy policy.

Support, beyond one inbox

General questions go to hello@surestepeducation.com; security reports to security@surestepeducation.com. District partners get more than an inbox: every pilot and agreement comes with a named founder contact and a direct line, because when a teacher is standing in front of a class with a tool that won't load, "we'll get back to you" isn't an answer.

Continuity

Districts rightly ask what happens to their data and their workflows if a small vendor stumbles. Our agreements put the answer in writing: your records are always yours, exportable in standard formats on request; termination triggers certified return or deletion on your terms; and for district-wide agreements we offer source-code escrow and continuity arrangements so an adopted tool can't simply vanish. We'd rather earn renewal than lock you in.

The honest part

We're an early-stage company and we won't pretend otherwise. We don't yet hold our own SOC 2 report (our infrastructure providers do), and independent penetration testing is on the roadmap rather than behind us. What we offer in the meantime is surface area small enough to actually inspect: no ads, no trackers, one database, one region, and founders who will sit down with your IT team and walk through all of it. We welcome district-led security reviews — they make the product better.