Student data deserves serious protection.

Security and privacy controls

• Your Data Is Yours

  Districts own their content and data. We use it only to provide the service, never sell it, and never use it for advertising. Export everything at any time.

• FERPA, COPPA and State Privacy

  Built to support FERPA and COPPA obligations. We sign the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) and state addenda.

• A Separate Database for Every District

  Each district's data lives in its own database with its own credentials — never mixed in with another district's records.

• Encrypted Everywhere

  Data is encrypted in transit with TLS and at rest, with encryption keys managed in a dedicated key service.

• US-Only Hosting

  Application data, backups and AI processing stay in the United States.

• SSO and MFA

  Staff sign in with Google or Microsoft single sign-on. Multi-factor authentication protects every administrator account.

• Backups and Recovery

  Point-in-time recovery plus nightly encrypted backups for each district, so one district can be restored without touching any other.

• Least-Privilege Access

  Roles are scoped from district down to a single school. Any support access by our team is limited and logged.

• Responsible AI

  Our AI provider runs with zero data retention and no training on your data. Scout answers only from public district content and always says it's AI.

• 72-Hour Incident Notice

  If an incident affects your data, we notify your district within 72 hours, with what happened and what we're doing about it.

• Accessibility Commitment

  We design to WCAG 2.2 AA, test with automated and manual checks, and publish an accessibility conformance report.

• Monitoring and Scanning

  Continuous dependency and code scanning, logging and alerting across the platform.