Security & Incident Response

We protect classroom data with account-level isolation, server-side access checks, managed sign-in, token-gated booking links, and a hosting platform that describes its infrastructure as encrypted in transit and at rest. See our Privacy Policy for details. No service is perfectly secure, so we also plan for things going wrong.

• We act quickly. We contain the issue, secure affected systems, and preserve evidence.
• We tell you. If your data is affected, we will notify you without undue delay at the email on your account. For schools and districts with a signed DPA, the DPA’s notice terms apply.
• We are specific. Our notice will explain what happened, what kinds of data were involved, what we have done, what you should do, and who to contact.
• We work with schools. You and your school decide how to notify families and meet any legal duties. We will give you the information you need to do that.
• We follow up. After the incident we send a summary of the cause and the changes we made to prevent a repeat.

Email hello@classharborapp.com with "Security" in the subject line. We aim to acknowledge reports within a few business days. Please do not access other people’s data, and give us reasonable time to fix the issue before sharing it publicly.

• Use a strong, unique sign-in and enable multi-factor authentication if available.
• Revoke conference booking links when they are no longer needed.
• Avoid entering sensitive categories of information (see the Terms of Service, "Your responsibility for classroom data").
• Tell us immediately if you notice anything unusual in your account.