Security monitoring

The record, not the reassurance.

Your families’ information is the most sensitive thing a school hands to an outside company. Most vendors describe how carefully they treat it. We would rather show you. Every hour, automatic checks run over every record we hold for you and alert a staff inbox if anything looks wrong — and a second set runs more often still, on separate equipment, so that one system failing does not mean nobody is looking. This page is written by those checks, not by us — it updates on its own, whether the news is good or not.

736

Times we’ve checked your data

3,680

Separate safety checks run

Times a school had to be notified

Problems open right now

Covering the past year · this page refreshes itself every hour · last practice alarm July 31, 2026

What we check, every hour

Each one answers a different question about your data. None of them needs a person to remember to run it.

Are all your records still there?

We count every student, family, and staff record we hold for you. If a large number disappeared — or a large number appeared that shouldn’t have — we know within minutes.

Is anyone trying to break into the dashboard?

We watch for someone guessing at passwords or sign-in links, failing repeatedly, or hammering the login page. Opening a dashboard takes both a password and a one-time link we email, so a guessed password on its own gets nobody in — but we treat a run of failures as an alarm, not as noise.

Is anything sending messages it shouldn’t?

A sudden flood of texts or emails leaving the system is what it looks like when someone else has the controls. We check the volume every time.

Has our name turned up in a known data leak?

Every day we check our web addresses against the public register of reported breaches.

Is your data still being handled inside the United States?

Your agreement says school information is processed on US-based systems. We re-confirm that setting rather than assume it stayed put.

Has anyone opened your stored school passwords?

Where you’ve connected your student information system, those credentials sit sealed. Any attempt to open one is recorded.

We publish what we check and how often. We don’t publish the exact point at which each check sounds the alarm — that would tell someone testing our defences precisely how far they could go without setting it off.

If something is ever found

The part worth knowing in advance, so it isn’t being explained to you for the first time on a bad day.

We find out first

The check that spots it alerts a monitored staff inbox immediately, day or night. Nobody has to be watching a screen for this to work.

You hear from us within 48 hours

Your named contact gets a direct message from us — what happened, when, and which information may be involved. New York law allows a vendor seven days. We commit to two, so that more of your own deadline is left for you.

You decide what families are told

Notifying parents is your school’s decision and your school’s voice. We give you the list of affected records and help you prepare it — we never contact your families about an incident ourselves.

It appears here once closed

When the investigation finishes, the incident and its outcome are added to this page, whatever the outcome was.

The last few weeks

Week of	Times checked	Safety checks	Longest wait between checks
Aug 23	23	115	1.0h
Aug 16	168	840	1.0h
Aug 9	169	845	1.0h
Aug 2	235	1175	1.0h
Jul 26	141	705	1.0h

We show the longest we ever went between checks, not the average. An average would hide the one long stretch that actually mattered, which is the number you’d want to know about.

What we’ve found so far

No school has ever had to be notified.

The alerts our checks have raised were looked into and turned out to be routine — planned clean-ups of our own test data, and similar. Every alert is listed here once we’ve finished looking into it, whatever the answer turned out to be. We also run practice alarms on a schedule, to prove the alert still reaches a person; 3 recorded here.

Anything we find appears here once we’ve finished looking into it. While we’re still investigating, the schools affected hear from us directly and first — never from this page. No parent should learn their child’s information was involved by reading a company’s website. This list starts on August 1, 2026, the day we began serving schools. Anything before that came from building and testing the system on made-up sample data, never a real family’s record. Those earlier alerts are kept in full in our own records.

The commitments behind this page

Monitoring is one half. The other half is written down and signed: our FERPA Data Processing Agreement, the New York Education Law §2-d Addendum, the Data Security and Privacy Plan under 8 NYCRR §121.6, and the insurance standing behind them.

Read the agreements