The security section of a vendor questionnaire wants the same handful of facts every time: where the data is, how it is encrypted, who can reach it, what happens when something goes wrong. Here they are, in the order the forms usually ask.
Hosting
- Google Cloud Platform, United States. Application and database run in Google Cloud regions in the US. Data is not transferred across borders.
- Signed data processing agreement with Google Cloud.
- Payments are processed by Stripe under Stripe’s DPA. Card numbers never touch our systems.
Encryption
- In transit: TLS 1.2 or higher, enforced on the web dashboard, the mobile app, and every API call.
- At rest: AES-256 on the database, file storage, and backups, with Google-managed keys.
Access control
- Role-based access inside the product: school, district, and region roles see only their own organization, see Signing In: Google, ClassLink, and Passwords.
- Least privilege for staff. Production access is limited to the engineers and support staff who need it, reviewed at least yearly. Admin and data-access events are logged.
- No third-party access to the production database.
Backups and recovery
Automated daily backups, encrypted, with point-in-time recovery for the production database. Backups live in the same US Google Cloud environment.
Retention and deletion
- Your institution owns its data and can request export or deletion at any time, see What Data Does Education Walkthrough Collect?.
- Deleted accounts: 90-day soft delete, then permanent removal.
- Deletion requests are completed within 30 days. On termination of an agreement, district data is returned or securely destroyed.
Incident response
If a security incident affects your data, we notify affected institutions without unreasonable delay and within the timelines required by applicable state and federal law, and we can commit to a specific notification window in your DPA.
Standards and audits
Our controls follow the NIST Cybersecurity Framework. We do not currently hold a SOC 2 report. If your district requires one, tell us; the request is counted in our planning.
Frequently asked questions
Q: Which domains and ports does IT need to allow?
A: See the Technical Specifications and IT Deployment Guide.
Q: Is there multi-factor authentication?
A: Not built into Education Walkthrough today. Schools that sign in with Google get Google’s MFA, see Signing In.
Q: Can we get a security questionnaire or DPA completed?
A: Yes. submit a support ticket with the form. For the compliance side, see FERPA and Education Walkthrough.