# Backpack Education — Security Summary

Backpack Education — version 2026.1 — September 21, 2026

Provider makes the following statements about the security of Backpack Education. A district's Data Steward may request the full HECVAT Lite questionnaire; the statements below are the controls districts most often need before enabling single sign-on.

## Tenant isolation

- Every district-scoped table carries an organization identifier. PostgreSQL row-level security policies keyed on the request's organization reject any query that lacks the correct predicate, so a coding mistake returns no rows rather than another district's rows.
- An automated isolation suite runs on every deployment and attempts a cross-tenant read on each district-scoped route. The report is available to the Data Steward in the district console.
- District tenants and Provider's consumer product share a codebase but never a screen: consumer operations staff cannot open a district tenant, and district operations staff cannot open a consumer account.

## Identity and access

- District staff sign in only through the district's identity provider (Clever, ClassLink, Google Workspace, or Microsoft Entra). Provider stores no staff passwords. Once a district enforces SSO, Provider refuses any other sign-in method for that district's email domains.
- Students sign in on a district device only through a teacher-opened device session, by picture grid, printed badge, or student SSO as the school chooses. No student holds a password.
- Provider operators sign in with hardware or app-based multi-factor authentication. Operator access to student rows requires a break-glass procedure: a typed justification, a one-hour window, and a second operator's approval. Every break-glass event appears in the district's own audit log.

## Data protection

- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256) for all data. OAuth tokens and signing secrets are additionally sealed with application-level keys.
- Backups are encrypted and expire within 30 days; a district's deletion is complete from backups within that window.
- Video playback uses YouTube's privacy-enhanced embed; no district identifier leaves Provider's systems to YouTube.

## Operations

- Change control through pull request review; no direct production changes.
- Vulnerability disclosure at security@ghz.company with a 5-business-day acknowledgement.
- Incident response: containment, district notice within the statutory 30 days and a target of 72 hours, root-cause report to the Data Steward.
- Third-party attestations: Provider relies on subprocessor SOC 2 reports and will pursue iKeepSafe COPPA and FERPA assessments; certificates are added to the document room when issued.