Security Overview

Impact Suite is built with security as a foundational principle. Our program is organized around the NIST Cybersecurity Framework and protects student, family, and staff data through layered technical, administrative, and physical controls.

Hosting & infrastructure

• Amazon Web Services (AWS), United States region (us-west-2 / Oregon) — U.S. data residency.
• Virtual Private Cloud (VPC) isolation, security groups and network ACLs, and TLS termination at the load balancer.
• AWS maintains SOC 2 Type II, ISO 27001, and FedRAMP authorizations for the underlying infrastructure.
• 99.9% uptime target with redundant, multi-region architecture.

Encryption

• At rest: AES-256 for all stored data (PostgreSQL/RDS, S3), with keys managed in AWS KMS.
• In transit: TLS 1.2 / 1.3 for all connections, including browser, API, and database traffic.
• Encrypted, geographically distributed backups (daily, 30-day retention).

Access control

• Multi-factor authentication required for administrative accounts (TOTP).
• Role-based access control with a district/school hierarchy and least-privilege defaults; access is scoped dynamically by assignment.
• Single Sign-On via SAML 2.0 and district identity integration.
• Secure session handling with automatic timeout and invalidation on password change or security event.

Monitoring & response

• 24/7 automated monitoring (AWS CloudWatch), authentication and admin-action logging, and anomaly alerting.
• A documented incident response plan with a defined response team and annual tabletop testing.
• Security and audit logs retained for six years; operational logs for 30 days.

Governance

• Security and privacy policies are documented, reviewed quarterly, and managed on our compliance platform.
• Automated dependency and vulnerability scanning, with critical patches applied within 30 days.
• A SOC 2 Type II program is underway (status available on request).

For the full picture, see our subprocessor list, data flow, and AI data handling documentation.