Security Whitepaper 2026

Security & Compliance

How ToolBoxAI protects student data with security controls built for K-12 education.

Last updated: 14 September 2026 | Version 2.2

100%

Data Encrypted

24/7

Uptime Checks

Data Sold

7 yrs

Audit Log Retention

1 hr

P1 Response (Business Hours)

99.5%

Availability Target

Overview

The ToolBoxAI Educational Platform is a game-based learning system built from the ground up with privacy-by-design principles. Our architecture ensures that student data protection is not an afterthought but the foundation of every technical decision we make.

This whitepaper outlines the security measures, compliance frameworks, and operational practices that protect our users. It is intended for school administrators, IT directors, and compliance officers evaluating our platform for adoption.

Our Security Philosophy

Minimal identifiers: student records use integer IDs, and identifiers are hashed in logs
Minimal data collection: Only what is strictly necessary for educational outcomes
Defense in depth: Multiple independent layers of security controls
Continuous monitoring: uptime checks from four regions, with alerts on failure
Transparency: documented controls and a public vulnerability disclosure contact

Data Protection

Every piece of data within the ToolBoxAI Educational Platform is protected using multiple layers of encryption, access controls, and monitoring.

Encryption

AES-256 encryption at rest for all stored data
TLS 1.3 encryption in transit for all network communications
Database-level encryption via Supabase with row-level security (RLS)
Key management through dedicated HSM-backed key vaults
Automatic key rotation on a 90-day cycle

Access Control

Role-based access control (RBAC) with four tiers: Student, Teacher, Admin, Super Admin
Multi-factor authentication (MFA) required for all teacher and admin accounts
Session tokens with short TTL and automatic refresh rotation
IP allowlisting available for district-level deployments
Every API endpoint enforces authentication and authorization checks

Data Retention & Deletion

Student progress data retained only for the duration of active enrollment
Automatic data deletion within 30 days of account deactivation
Parents can request immediate deletion via the consent management portal
Anonymized aggregate analytics retained separately for platform improvement
Data export available in standard formats (CSV, JSON) on request

Compliance

The ToolBoxAI Educational Platform maintains compliance with all major educational data protection regulations. Select a framework below for details.

We meet all FERPA requirements for the protection of student education records. Parents and eligible students have full rights to inspect, amend, and control disclosure of their educational records.

Student records encrypted at rest and in transit with AES-256
Role-based access control limits data visibility to authorized school officials
Complete audit trails for every data access event
Parents can request record inspection or amendment at any time
Directory information opt-out supported for all students
Annual notification of rights provided to all parents

Our controls are designed to meet the 2026 COPPA rule update: verifiable parental consent, data minimization, and strict limits on data collected from children under 13.

Verifiable parental consent obtained before any data collection
Data minimization: only essential educational data is collected
No behavioral advertising or third-party tracking of children
Parents can review, delete, or refuse further collection at any time
Student records are keyed by integer IDs, and identifiers are hashed in logs
Child-friendly privacy notices written in plain language

Our platform helps schools meet CIPA requirements by providing built-in content filtering, monitoring capabilities, and age-appropriate safeguards for all online activities.

Built-in content filtering for all user-generated content
AI-powered monitoring detects inappropriate material in real time
Internet safety education integrated into lesson content
Teacher-controlled access levels and activity monitoring dashboards
Automated blocking of harmful or obscene material
Activity and progress reports for teachers and administrators

Standards and Frameworks

CASE 1.1

Standards alignment and curriculum interoperability

Data subject rights

Data export and deletion requests handled on request

Infrastructure Security

Our multi-cloud infrastructure is designed for resilience, performance, and security across every layer of the stack.

Cloud Hosting

Railway (API) + Vercel (Frontend) + Supabase (Database) with automatic failover and geographic redundancy.

Network Security

WAF protection, DDoS mitigation, rate limiting on all endpoints, and automatic IP reputation scoring.

Container Security

Docker images scanned for CVEs on every build. Non-root containers with read-only file systems in production.

Dependency Scanning

Automated Dependabot and CodeQL analysis on all pull requests. Zero tolerance for critical vulnerabilities.

Secrets Management

All credentials stored in encrypted vaults. No secrets in code, environment files, or container images.

Monitoring & Logging

Structured logging with structlog, Prometheus metrics, Loki log aggregation, and Grafana dashboards.

Incident Response

Our incident response plan is tested quarterly through tabletop exercises and simulated breaches. Every team member knows their role.

0 - 15 min

Detection & Triage

Automated monitoring systems detect anomalies. On-call engineer is paged. Initial severity classification is made.

15 - 60 min

Containment

Affected systems are isolated. Threat is contained. Forensic data collection begins. Incident commander coordinates response team.

1 - 4 hours

Eradication & Recovery

Root cause identified and eliminated. Systems restored from clean backups. Integrity verification performed across all affected data.

4 - 24 hours

Notification

Affected schools and parents notified per regulatory requirements. Transparent communication about impact, actions taken, and preventive measures.

1 - 30 days

Post-Incident Review

Detailed post-mortem conducted. Lessons learned documented. Security controls updated. Results shared with affected parties.

Responsible Disclosure

We welcome security researchers to report vulnerabilities responsibly. Please send details to security@toolboxcity.ai. We commit to:

Acknowledgment within 1 business day
No legal action against good-faith researchers
Public credit (with permission) in our security advisories
Resolution timeline communicated within 72 hours

Contact

Our security and compliance team is available to answer questions, provide additional documentation, or schedule a security review call.

Security Team

security@toolboxcity.ai

Vulnerability reports, security questions, and incident reporting

Compliance Team

privacy@toolboxcity.ai

FERPA, COPPA, CIPA inquiries, DPA requests, and audit documentation

Data Protection Officer

privacy@toolboxcity.ai

Data subject access requests, deletion requests, and privacy concerns

General Inquiries

support@toolboxcity.ai

Partnership inquiries, sales, and platform demonstrations

Back to Home ToolBoxAI

This security whitepaper is provided for informational purposes. For the most current information about our security practices, please contact security@toolboxcity.ai. Security infrastructure powered by ToolBoxAI.

Loading…