District-procurement-ready. Download the signed DPA and Security One-Pager, review the full subprocessor list, security architecture, and SOC 2 status. Everything documented. Nothing to hide.
Both documents are current as of the date you download them. Every download is logged for audit trail (see subprocessor table). For a countersigned copy, email trust@cyberheroeshq.com.
FERPA school-official exception framing, COPPA authorization mechanism, data categories, retention schedule, deletion workflow, security commitments, and the full subprocessor list — suitable for district legal review.
Auth model, encryption in transit & at rest, data residency, access controls, incident-response SLA, backup & recovery objectives, and vulnerability-disclosure policy — for district IT and CISO review.
Full conformance statement covering every role dashboard and the mission gameplay SPA. Scope, methodology, screen-reader pass results, and out-of-scope vendors — for Section 508 / IDEA-driven district reviews.
✓ WCAG 2.1 AA · 51 routes auditedIndependent certifications appear with the certifying body's name and are linked where available. Pending items are marked honestly with the target date.
The same controls listed in our Security One-Pager, summarized here for quick procurement review. For the full one-pager, see the Security PDF.
TLS 1.2+ enforced on every public endpoint. HSTS preloaded. No weak ciphers permitted.
AES-256 on all database storage. Backups encrypted with rotating keys.
bcrypt (cost ≥ 12) for all credentials. Session cookies are HttpOnly, Secure, SameSite=Lax. Role-based access control on every route.
Daily encrypted backups with 35-day retention. Point-in-time recovery available. Backups stored in a separate region.
24-hour notification for confirmed breaches affecting customer data. Full postmortem published within 72 hours.
Annual third-party penetration test against the production platform. Findings tracked to remediation in our public Hall of Fame.
Researchers: report findings to security@cyberheroeshq.com. Our policy (90-day SLA, safe harbor, no legal threat) is at /security.
Every subprocessor that touches student or teacher data. We will notify schools of any material change at least 30 days in advance. DPA on file ↔ a signed data-processing agreement is in place with the named vendor.
| Subprocessor | Purpose | Data Category | Region | DPA on file |
|---|---|---|---|---|
| Render | Application hosting & deployment | Application code; request logs (IP, timestamp); no student PII in logs. | 🇺🇸 US (Oregon) | DPA on file |
| Neon | PostgreSQL database hosting | All platform data (encrypted at rest, AES-256). | 🇺🇸 US-East (AWS) | DPA on file |
| Postmark | Transactional email (teacher & parent notifications) | Teacher email, parent email (opt-in only), student hero username in subject lines only. | 🇺🇸 US | DPA on file |
| OpenAI | AI mentor (Cipher follow-on, content generation) | Session-scoped, anonymized prompt content. No PII forwarded — no name, email, or student ID. | 🇺🇸 US | DPA on file |
| Anthropic | Fallback AI mentor (Cipher primary) | Session-scoped, anonymized input only. No PII forwarded. Anthropic does not train on or store customer data under our DPA. | 🇺🇸 US | DPA on file |
| Stripe | Payment processing (Family & District subscriptions) | Billing email, payment card data (held by Stripe — never stored by us). No student data is shared. | 🇺🇸 US | DPA on file |
| OAuth (teacher & parent sign-in only) | OAuth tokens for sign-in. No student data flows through Google — student accounts use teacher-provisioned codes. | 🇺🇸 US | Limited scope |
CyberHeroesHQ aligns with the Student Data Privacy Consortium (SDPC) national standard contract clauses and the California Student Privacy Alliance (CSPA) framework. The clauses listed below are honored in our standard DPA.
Processor uses Student Personal Information only to deliver the educational service described in the contract, and never for any other commercial purpose.
No behavioral advertising, no cross-context tracking, no building of personal profiles for any purpose other than the named educational service.
30-day notice before a new subprocessor begins processing customer data. Subprocessors list is part of the DPA and refreshed at /trust#subprocessors.
Hard purge within 30 days of written Controller request. Annual security-questionnaire responses and DPA-section review. Indemnification clauses in the standard DPA mirror SDPC national terms.
Telemetry, anonymized before reaching AI vendors. All retention windows listed below are the maximum — shorter on account close or soft delete.
Encryption covers data in transit, at rest, in backups, and in session cookies. Session and credential secrets are managed out-of-band of source control.
TLS 1.2+ enforced on every public endpoint. HSTS preloaded. HTTP requests 301-redirected to HTTPS automatically.
AES-256 on all database storage via AWS-managed KMS. Backups encrypted with rotating keys.
bcrypt at cost ≥ 12. Session cookies are HttpOnly, Secure, SameSite=Lax.
Session secrets and platform credentials managed as platform-injected env vars — never in source or version control.
In the event of a confirmed security incident involving Student Personal Information, we notify our district and school customers via the security@cyberheroeshq.com contact chain.
Three explicit timelines govern Student Personal Information. They are honored across primary, replica, and backup storage.
We collect the minimum necessary to run a classroom. No PII beyond classroom-assigned identifiers. No behavioral advertising. No third-party data sharing.
All student and teacher data is stored in US-based infrastructure (Neon PostgreSQL on AWS US-East, application hosting on Render Oregon). No data is transferred outside the United States.
CyberHeroesHQ is designed for children ages 8–18. For under-13, COPPA requires verifiable parental consent before collecting information — obtained at family account creation via an explicit consent checkbox.
CyberHeroesHQ operates as a school official under the FERPA school official exception (34 C.F.R. § 99.31(a)(1)). The school or district remains the data controller.
All student accounts are created and managed by teachers through the Teacher Portal. Students join via classroom code (CYBER-XXXX format) issued by their teacher.
The school or district controls which students are enrolled, which classrooms exist, and when accounts are terminated. CyberHeroesHQ processes data only as directed.
For under-13, schools act in loco parentis under the COPPA school authorization mechanism (16 C.F.R. § 312.5(b)(1)). By enrolling under-13 students, the school represents it has authority to consent.
Schools are responsible for removing students who should no longer have access. Deletion requests can be submitted at privacy@cyberheroeshq.com.
Answered directly, without weasel words.
For districts that need a deeper architectural conversation — bring your own questionnaire, your DPA template, or just an introductory call. We respond within 2 business days.
Or email directly: compliance@cyberheroeshq.com
For districts that want the comprehensive bundle — a countersigned DPA, security questionnaire responses, compliance crosswalk, and reference contacts.