Security and Privacy Overview
Our Commitment to Security and Data Privacy
Student resiliency data requires the highest level of protection and privacy considerations. Our platform is built on the principle that any information collected by Terrace Metrics must be handled with exceptional care and security. Every feature and process in our system is designed to protect student privacy while enabling schools and parents to provide effective support. We regularly review and update our security measures to address emerging threats and maintain compliance with evolving educational privacy standards.
Data Protection and Privacy
Data Protection
All student data is protected using industry-standard encryption technologies throughout its lifecycle in our system. We implement strict data segregation to ensure that each school’s data remains separate and secure. Our data minimization practices ensure we only collect and retain information that directly serves the purpose of supporting student resiliency assessment and reporting.
We maintain detailed audit logs of all data access and modifications, enabling us to track and verify appropriate usage of student information.
Access Control
We implement strict authentication measures including password complexity requirements.
Our role-based access control system is specifically designed for the educational environment, with carefully defined permissions that match the responsibilities of each role within the school system:
- School counselor/social worker/school psychologist/ and/or nurse(s) and key district and school
administrators - Parent/Guardians
- Students
Our platform supports enterprise-grade Single Sign-On (SSO) integration, providing secure and streamlined access for all students. SSO configuration is available through industry-standard protocols OpenID Connect, allowing seamless integration with popular identity providers such as:
- Google Workspace for Education
- ClassLink
- Clever
Survey Security
Our survey platform incorporates multiple security layers to protect the integrity and confidentiality of student responses. Each survey session is uniquely encrypted and tied to a specific authentication code, preventing unauthorized access or duplicate submissions. Response data is immediately encrypted upon submission and stored in secure, isolated databases with strict access controls.
Only designated school staff can see the student’s responses, and only designated school staff and parents/guardians have access to the student’s report.
Infrastructure Security
Cloud Security
Our AWS serverless infrastructure is designed with a security-first approach, utilizing AWS’s most robust security features and best practices. We implement comprehensive network security controls including AWS WAF to protect against unauthorized access and common web attacks. Our serverless architecture significantly reduces the attack surface by eliminating server management concerns and leveraging AWS’s built-in security features. We actively monitor and implement AWS Security Bulletins to ensure our application remains protected against newly identified vulnerabilities and threats.
Application Security
The application is built using secure development practices including code review requirements, security testing in the CI/CD pipeline, and regular dependency updates to address known vulnerabilities. We maintain separate environments for development, testing, and production with appropriate security controls for each.
Compliance and Privacy Standards
Data Compliance
Our platform maintains strict compliance with comprehensive data protection regulations including FERPA, COPPA, and other applicable privacy laws that govern the collection and processing of personal information. Our compliance program includes regular updates, and ongoing staff training to address evolving privacy regulations and industry standards. We promptly address any compliance-related concerns raised by schools, parents, or regulatory authorities.
Data Governance
We maintain a commitment that we do not now, nor will we ever, sell any personally identifiable
information to third parties. This is not just a policy, but a fundamental principle built into our operational DNA and technical architecture.
Our platform uses student data solely for:
- Generating resiliency insights for authorized school staff
- Creating individual reports for parents/guardians
- Improving the accuracy and effectiveness of our resiliency assessments
Our data governance framework ensures consistent and secure handling of student information throughout its lifecycle. We maintain a clear process of data flows, access controls, and retention policies, which are regularly reviewed and updated. All data processing activities are logged and monitored to ensure compliance with our governance policies.
Operational Security
Incident Response
Our incident response plan includes detailed procedures for identifying, containing, and resolving security incidents. We maintain a dedicated incident response team to address security concerns. We provide transparent communication to affected parties during and after security incidents, including detailed incident reports and remediation steps.
Business Continuity
Our platform is designed with redundancy and fault tolerance to ensure continuous availability of critical services. We maintain comprehensive backup systems with regular testing to ensure data can be recovered quickly if needed. We implement automated monitoring and alerting systems to detect and respond to potential service disruptions.
Communication and Support
Security Communication
We maintain clear communication channels for security-related updates and incidents. Regular security updates are provided to school administrators and other stakeholders. Our security team is available for consultation and questions regarding our security practices.
Support Channels
Our support team is trained in handling security and privacy-related inquiries with appropriate sensitivity and urgency. We maintain separate channels for technical support, privacy questions, and emergency security issues to ensure proper handling of each type of inquiry. We provide guaranteed response times for security-related support requests based on severity levels.
Ongoing Commitment
We dedicate significant resources to continuously improving our security measures and privacy protections. Our security team regularly reviews and updates our security controls based on new threats and industry best practices. We actively participate in education technology security forums and stay current with emerging security standards. Regular feedback from schools, parents, and security experts helps us enhance our security program.