Security & Privacy Summary

Regulatory & framework alignment

• FERPA. WiseBoard handles student educational records as a "school official" under district direction. No secondary use, no advertising, no resale.
• COPPA. Teacher- and admin-managed accounts only ; students do not create accounts directly. Districts provide the school-authorized consent for under-13 users.
• State privacy laws. Practices align with SOPIPA (CA), Ed Law 2-d (NY), HB 1428 (CO), SB 564 (TX), and the broader SOPIPA-derived state laws. State-specific exhibits available.
• SDPC NDPA. We sign the National Data Privacy Agreement (NDPA) and accept most district-specific exhibits without negotiation.
• Frameworks. Controls mapped to NIST 800-53 moderate baseline and CIS Controls v8. SOC 2 Type II report targeted by Q4.

Subprocessors

Districts are notified at least 30 days before any new subprocessor handling student data is added.

Audit, export & deletion

• Admin audit log. Every privileged action ; roster sync, role grant, data export, account deletion ; recorded with actor, timestamp, IP, and target. Searchable for 13 months in-app and exportable as CSV.
• IEP / 504 / RTI compliance log. Per-student record of accommodations applied during each lesson; printable on demand for IEP meetings or administrator audits.
• Data export. Districts can export all rosters, classroom grade snapshots, lesson content, and behavior logs as CSV/JSON at any time, including at end of contract.
• Deletion. District-initiated deletion is irreversible; data is purged from primary systems within 30 days and from encrypted backups within 60 days. Written confirmation provided.

Operational security

• Access. Role-based, MFA-enforced, audit-logged. Production access is time-bound (JIT) and reviewed quarterly.
• Vulnerability management. Continuous dependency audits (Dependabot + automated SAST); annual third-party penetration test; coordinated disclosure program.
• Backups. Encrypted point-in-time backups, 30-day retention, restore drills quarterly. RPO 1 hour, RTO 4 hours.
• Incident response. 24-hour notification SLA for confirmed security incidents affecting district data; written post-incident report within 10 business days.
• AI guardrails. Pip uses enterprise endpoints with zero-retention contracts; student PII is filtered before inference and never used to train external models.

Insurance

• Cyber liability ; $2,000,000 per occurrence / aggregate
• Errors & Omissions (Tech) ; $1,000,000 per claim
• Commercial General Liability ; $1,000,000 per occurrence
• Certificates of insurance issued to the district on request, naming the district as additional certificate holder.

Accessibility & Section 508

• Standards. WCAG 2.2 Level AA · Section 508 (2018 ICT Refresh) · EN 301 549 v3.2.1. Two published VPATs: main product (Dashboard, Lessons, Performance Tracker) and Pip's Arcade companion (student game suite).
• April 30, 2026 audit pass. Pip's Arcade companion VPAT closed its remaining Medium and High backlog items; four WCAG criteria promoted to "Supports" in this pass (1.1.1, 1.4.3, 1.4.11, 4.1.3), building on 2.3.3 closed in the April 28 pass. No Medium or High items remain open across either VPAT.
• AT compatibility tested. NVDA, VoiceOver, TalkBack, JAWS; Voice Control on macOS / iPadOS, Voice Access on Android; Apple Switch Control with single- and two-switch scanning.
• CI regression guard. classroom-a11y-lint + classroom-a11y-axe run on every change ; zero serious / critical axe violations across all 3 public pages and 15 audited authenticated teacher pages.
• Reporting SLAs. 2 business days to acknowledge an accessibility report; 10 business days to provide a remediation plan; P1 SLA for any barrier preventing a teacher from completing a core workflow.