Security & Compliance
Our security posture and the compliance considerations that shape how we build.
Security posture
Security is treated as foundational rather than optional—particularly because our work can involve sensitive information about minors and their wellbeing. We build on established, independently-audited infrastructure and design our own practices around the principles expected of healthcare and education environments.
- Confidentiality, integrity, availability. We design toward the core security principles that regulated sectors depend on.
- Least privilege. Access to sensitive systems and data is scoped to what a role genuinely requires.
- Defense in depth. We favor layered safeguards rather than relying on any single control.
- Auditability. We prefer systems that can be reviewed and reconstructed, so security-relevant actions are accountable.
- Responsible disclosure. We welcome good-faith reports of potential vulnerabilities and address them seriously.
For security questions or to report a concern, contact contact form. This describes our security principles, not a specific certification.
How compliance works here
We're candid about what compliance looks like at our stage. We build on established cloud and data infrastructure whose providers maintain their own independent certifications, including SOC 2. We rely on those audited platforms and vendors, and we design our own practices in line with the same principles.
We have not, at this time, completed our own company-level SOC 2 or equivalent third-party audit. As we grow and our products' needs require it, pursuing formal certification is part of our roadmap. We'd rather state this plainly than imply a certification we don't yet hold—partners evaluating us can ask for specifics, and we'll answer directly.
Questions
Contact contact form.