Security and Incident Response

Our Approach

Academoo uses technical and organizational safeguards designed to protect teacher, school, and student information. No internet service can promise perfect security, so we also maintain a written process for finding, containing, investigating, remediating, documenting, and communicating security incidents.

Safeguards

• Encrypted connections for information sent between browsers and Academoo.
• Authentication, row-level database permissions, and least-privilege service access.
• Hashed report-access tokens and short-lived hashed network identifiers used for rate limiting.
• Rate limiting and abuse-prevention controls on sensitive public endpoints.
• Error and reliability monitoring configured to reduce unnecessary personal-data capture.
• Service-provider access limited to operating, securing, supporting, and improving Academoo.

Incident Response

When a suspected incident is reported, our response process includes:

1. Recording the report, preserving relevant evidence, and assessing urgency.
2. Containing affected access, credentials, systems, or providers.
3. Investigating what happened, what information was involved, and who was affected.
4. Removing the cause, safely restoring service, and monitoring for recurrence.
5. Assessing notification duties and communicating with affected schools.
6. Documenting lessons learned and completing corrective actions.

School Notification

If we determine that a breach involved a school's student information, we will notify the affected school without unreasonable delay and no later than 30 calendar days after that determination. We will follow a shorter deadline when required by a signed school agreement or applicable law. A lawful law-enforcement request may require notice to be delayed.

When known and appropriate, our notice will describe the incident, the approximate date or date range, the information involved, actions taken to contain and remediate it, steps the school can take, and a contact for follow-up. We will reasonably cooperate with the school's investigation and notification obligations. Allocation of credit-monitoring, legal, audit, notification, or other response costs will follow the signed school agreement and applicable law.

Report A Security Concern

Email support@academoo.com with the subject “Security concern.” Please do not include student records, passwords, access codes, or other sensitive information in the initial email. We will arrange an appropriate way to exchange details if needed.

For more information, see our Student Privacy overview and Privacy Policy.