Security Overview
Our security program, encryption standards, hosting, and access controls at a glance.
Impact Suite is built with security as a foundational principle. Our program is organized around the NIST Cybersecurity Framework and protects student, family, and staff data through layered technical, administrative, and physical controls.
Hosting & infrastructure
- Amazon Web Services (AWS), United States region (us-west-2 / Oregon) — U.S. data residency.
- Virtual Private Cloud (VPC) isolation, security groups and network ACLs, and TLS termination at the load balancer.
- AWS maintains SOC 2 Type II, ISO 27001, and FedRAMP authorizations for the underlying infrastructure.
- 99.9% uptime target with redundant, multi-region architecture.
Encryption
- At rest: AES-256 for all stored data (PostgreSQL/RDS, S3), with keys managed in AWS KMS.
- In transit: HTTPS connections to the Impact Suite Schools applications (portal.impactsuite.com, admin.portal.impactsuite.com, sales.impactsuite.com, www.safetip.org) and API (api.core.impactsuite.com) use TLS 1.2 or TLS 1.3. Those applications and our mobile app call the API over HTTPS. HTTPS connections to our AWS S3 storage, which browsers use to transfer files directly, also use TLS 1.2 or TLS 1.3.
- Encrypted, geographically distributed backups (daily, 30-day retention).
Access control
- Multi-factor authentication required for administrative accounts (TOTP).
- Role-based access control with a district/school hierarchy and least-privilege defaults; access is scoped dynamically by assignment.
- Single Sign-On via SAML 2.0 and district identity integration.
- Secure session handling with automatic timeout and invalidation on password change or security event.
Monitoring & response
- 24/7 automated monitoring (AWS CloudWatch), authentication and admin-action logging, and anomaly alerting.
- A documented incident response plan with a defined response team and annual tabletop testing.
- Security and audit logs retained for six years; operational logs for 30 days.
Governance
- Security and privacy policies are documented, reviewed quarterly, and managed on our compliance platform.
- Automated dependency and vulnerability scanning, with critical patches applied within 30 days.
- SOC 2 in progress: Type I targeted end of 2026, Type II end of 2027. No report is issued yet; a status letter is available on request.
For the full picture, see our subprocessor list, data flow, and AI data handling documentation.