Security Overview

Impact Suite is built with security as a foundational principle. Our program is organized around the NIST Cybersecurity Framework and protects student, family, and staff data through layered technical, administrative, and physical controls.

Hosting & infrastructure

• Amazon Web Services (AWS), United States region (us-west-2 / Oregon) — U.S. data residency.
• Virtual Private Cloud (VPC) isolation, security groups and network ACLs, and TLS termination at the load balancer.
• AWS maintains SOC 2 Type II, ISO 27001, and FedRAMP authorizations for the underlying infrastructure.
• 99.9% uptime target, with a Multi-AZ database that fails over automatically and a load balancer spanning two Availability Zones. The service runs in one U.S. region; there is no standby second region.

Encryption

• At rest: AES-256 for all stored data (PostgreSQL/RDS, S3). The database and its backups are encrypted under an AWS KMS key; S3 uses S3-managed keys.
• In transit: TLS 1.2 / 1.3 for all connections, including browser, API, and database traffic.
• Encrypted daily database backups, retained 7 days and kept within the Oregon region.

Access control

• Passwordless sign-in: every user, in every role, signs in with a six-digit one-time code sent to their registered phone or email. That is single-factor authentication. Districts that require multi-factor authentication sign in through their own identity provider (below), which then enforces it.
• Role-based access control with a district/school hierarchy and least-privilege defaults; access is scoped dynamically by assignment.
• Single sign-on through our identity partner, Ednition RosterStream, which federates with your district’s identity provider and with ClassLink.
• Secure session handling with automatic timeout and invalidation on password change or security event.

Monitoring & response

• 24/7 automated monitoring (AWS CloudWatch), authentication and admin-action logging, and anomaly alerting.
• A documented incident response plan with a defined response team and annual tabletop testing.
• Security and audit logs retained for six years; operational logs for 30 days.

Governance

• Security and privacy policies are documented, reviewed quarterly, and managed on our compliance platform.
• Automated dependency and vulnerability scanning, with critical patches applied within 30 days.
• SOC 2 in progress: Type I targeted end of 2026, Type II July 2027. No report is issued yet; a status letter is available on request.

For the full picture, see our subprocessor list, data flow, and AI data handling documentation.