# WiseBoard Security Overview

**Version 1.0 — April 18, 2026**

This document is a one-page summary of WiseBoard's security posture, intended for
district IT-security and procurement reviewers. For controls detail, request the
full Security & Privacy package at `info@mywiseboardclassroom.com`.

## Architecture

- Single-tenant logical isolation via `userId` / `organizationId` foreign keys, enforced at the `requireAuth` middleware layer on every authenticated route.
- Hosted on Replit Deployments (Reserved VM, US region) with managed PostgreSQL, managed object storage, and TLS-terminated edge.
- All inter-service traffic is HTTPS only. HSTS enforced.

## Encryption

- **In transit:** TLS 1.2+ (TLS 1.3 preferred). HTTPS-only cookies, `SameSite=Lax`, `Secure`, `HttpOnly`.
- **At rest:** AES-256 for PostgreSQL storage volumes and object storage (provider-managed keys).
- **Passwords:** stored as `bcrypt` hashes (cost factor ≥ 12). Plaintext passwords are never written to logs or DB.
- **Secrets:** managed via Replit Secrets, never committed to source.

## Access controls

- Role-based access at the application layer (`teacher`, `admin`, `owner`, plus `student` token scope for arcade).
- Production database credentials accessible only to the operator (Chaz Landry). 2FA enforced on Replit account, GitHub account, Stripe dashboard, and email provider.
- Administrative access is logged. Any production data export requires a written request through `info@mywiseboardclassroom.com`.

## Application security

- Input validation: Zod schemas on every API request body.
- SQL injection: Drizzle ORM parameterized queries. No string concatenation into SQL.
- XSS: React JSX escapes by default; `dangerouslySetInnerHTML` only in audited rich-text editor surfaces with sanitized HTML.
- CSRF: same-site cookies + JSON-only API contract. No HTML form-encoded mutating endpoints.
- Telemetry endpoint: per-IP token bucket rate limiter (60 events / 60 s), 8 KB body cap, strict zod schema.
- Dependency hygiene: `pnpm audit` on each release. Snyk/HoundDog scans available on request.

## Monitoring

- Vendor-neutral observability layer captures errors and structured events. Sentry hook is in place; activated by setting `SENTRY_DSN`.
- Slow-request tracking emits `slow_request` events above the configured threshold.
- Application uptime monitored externally (status page at `/status`).

## Vulnerability disclosure

- Report security issues to **info@mywiseboardclassroom.com**.
- Acknowledgement within 2 business days, triage within 5 business days. We coordinate disclosure with reporters and credit researchers in our hall of fame on request.
- Out of scope: social engineering, physical attacks, denial of service, vulnerabilities in third-party services we do not control.

## Backup & recovery

- Automated encrypted backups daily, retained 30 days.
- Quarterly restore drill against a staging copy.
- RPO 24 h. RTO 8 h for full Service restoration.

## Compliance

- FERPA-aligned. Designated as "School Official" under signed DPAs.
- COPPA: directed to teachers (adults). No direct collection from children under 13.
- State student-data-privacy laws covered: SOPPA (Illinois), SOPIPA (California), NY Ed Law 2-d, TX SB 820, CO CRS § 22-16-101 et seq.
- SDPC National DPA template available — download at [/trust/dpa-template.pdf](/trust/dpa-template.pdf) or editable [.docx](/trust/dpa-template.docx). We will sign your state's SDPC DPA on request. (Listing on the SDPC Resource Registry follows the first signed district DPA, per SDPC's process.)
- WCAG 2.2 AA conformance — see VPAT 2.4 at `/trust/vpat-2.4.md`.
- SOC 2 readiness assessed; Type I targeted on revenue trigger — see `/trust/soc2-readiness.md`.
- Cyber-liability + general-liability insurance bound — Certificate of Insurance available on request.