How ToolBoxAI protects 50K+ students with industry-leading security standards built for K-12 education.
Last updated: March 2026 | Version 2.1
The ToolBoxAI Educational Platform is a game-based learning system built from the ground up with privacy-by-design principles. Our architecture ensures that student data protection is not an afterthought but the foundation of every technical decision we make.
This whitepaper outlines the security measures, compliance frameworks, and operational practices that protect our users. It is intended for school administrators, IT directors, and compliance officers evaluating our platform for adoption.
Every piece of data within the ToolBoxAI Educational Platform is protected using multiple layers of encryption, access controls, and monitoring.
The ToolBoxAI Educational Platform maintains compliance with all major educational data protection regulations. Select a framework below for details.
We meet all FERPA requirements for the protection of student education records. Parents and eligible students have full rights to inspect, amend, and control disclosure of their educational records.
Our platform is fully compliant with the 2026 COPPA update including enhanced parental consent requirements, data minimization mandates, and strict limitations on data collection from children under 13.
Our platform helps schools meet CIPA requirements by providing built-in content filtering, monitoring capabilities, and age-appropriate safeguards for all online activities.
SOC 2 Type II
Independent security audit completed annually
iKeepSafe
California Student Privacy Certified
CASE 1.1
Standards alignment and curriculum interoperability
GDPR-K
Enhanced GDPR compliance for K-12 environments
Our multi-cloud infrastructure is designed for resilience, performance, and security across every layer of the stack.
Railway (API) + Vercel (Frontend) + Supabase (Database) with automatic failover and geographic redundancy.
WAF protection, DDoS mitigation, rate limiting on all endpoints, and automatic IP reputation scoring.
Docker images scanned for CVEs on every build. Non-root containers with read-only file systems in production.
Automated Dependabot and CodeQL analysis on all pull requests. Zero tolerance for critical vulnerabilities.
All credentials stored in encrypted vaults. No secrets in code, environment files, or container images.
Structured logging with structlog, Prometheus metrics, Loki log aggregation, and Grafana dashboards.
Our incident response plan is tested quarterly through tabletop exercises and simulated breaches. Every team member knows their role.
Automated monitoring systems detect anomalies. On-call engineer is paged. Initial severity classification is made.
Affected systems are isolated. Threat is contained. Forensic data collection begins. Incident commander coordinates response team.
Root cause identified and eliminated. Systems restored from clean backups. Integrity verification performed across all affected data.
Affected schools and parents notified per regulatory requirements. Transparent communication about impact, actions taken, and preventive measures.
Detailed post-mortem conducted. Lessons learned documented. Security controls updated. Results shared with affected parties.
We welcome security researchers to report vulnerabilities responsibly. Please send details to security@toolboxai.com. We commit to:
Our security and compliance team is available to answer questions, provide additional documentation, or schedule a security review call.
security@toolboxai.com
Vulnerability reports, security questions, and incident reporting
compliance@toolboxai.com
FERPA, COPPA, CIPA inquiries, DPA requests, and audit documentation
dpo@toolboxai.com
Data subject access requests, deletion requests, and privacy concerns
hello@toolboxai.com
Partnership inquiries, sales, and platform demonstrations
This security whitepaper is provided for informational purposes. For the most current information about our security practices, please contact security@toolboxai.com. Security infrastructure powered by ToolBoxAI.
© 2026 ToolBoxAI. All rights reserved.