Security overview
How Money Matters protects student data
A one-page summary for IT and data privacy reviewers. Ask us for the full data privacy agreement and a security questionnaire.
| In transit | HTTPS everywhere with HSTS; strict security headers and a Content-Security-Policy on every page. |
|---|---|
| At rest | Student records are encrypted with AES-256-GCM using a key only the server holds. Database access uses row-level security and a server-only key. |
| Passwords and codes | Adult passwords, student sign-in codes and security answers are stored only as salted PBKDF2 hashes (100,000 iterations). Five wrong tries lock an account for 15 minutes. |
| Sign-in | Clever and ClassLink single sign-on; Google and Microsoft for adults; access codes are single-use and tied to a device. New-device and password-change emails go to adults. |
| Monitoring | The administrator sees every sign-in, failed sign-in, sign-up and change, with approximate place and device (students: state and country only). Browser errors are reported without names or emails. |
| IP addresses | Used only for short rate limits (counters that expire within an hour) and never saved with an account or record. |
| Backups | Licenses and orders are backed up automatically every week (private, kept 90 days); administrators can download a full backup of their school’s data at any time. |
| Deletion | Administrators can delete any account and its records immediately; school data is deleted on request within the time your data privacy agreement sets. |
| Incidents | Schools are notified of a breach within the time set in the signed data privacy agreement (for example 72 hours under NDPA v2.2). |
| Subprocessors | Cloudflare (hosting), Supabase (database), Resend (email to adults only), Stripe (payments, adults only); Clever, ClassLink, Google (sign-in and Classroom), Microsoft, Facebook and your LMS only when your school or an adult turns them on. |
What we collect from students
Collected
- First name or nickname (as the teacher or parent types it)
- Grade, username and a hashed sign-in code
- Lesson progress, quiz and test scores, reflections
- Game challenges with classmates of the same teacher: the game, the scores and who sent them, shown as first name and last initial (kept 14 days)
- At sign-in: state, country and device type
- Only if a teacher adds it: the student’s school ID or school email, to match grades in Google Classroom or an LMS
Never collected
- Phone or home address, and no email unless a teacher adds a school email for the gradebook
- Date of birth, photos or voice
- Precise location or IP address
- Advertising or tracking data
Questions: [email protected]. See also student privacy laws.