Legal
Security
Written for the person doing a vendor review. It describes what is actually in place today, and is explicit about what is not.
Accounts and access
- Passwords are hashed with scrypt and a per-password salt. We never store or see them.
- Sessions are random tokens; only a hash is stored, so a copy of our database cannot be used to sign in as anybody.
- Sessions expire after 12 hours. Resetting a password destroys every session immediately.
- Password reset links are single-use, expire in an hour, and asking for a new one retires the old one. We never reveal whether an email address has an account.
- Access is checked on the server for every request, per school. Hiding a control in the interface is never treated as access control.
Data
- Encrypted in transit (TLS) and at rest by our database provider.
- Each school’s data is scoped by identifier on every query. There is no shared view.
- Backed up regularly, and — the part that matters — restores are tested. A backup that has never been restored is a belief, not a backup.
- Deleted 365 days after a subscription ends, backups included. See terms.
Change and monitoring
- Every change is version-controlled and covered by an automated test suite that must pass before it ships.
- Significant actions are written to an audit log — who did what, to which school, and when.
- Application errors are recorded and reviewed rather than discarded into a log file.
What we do not have
No SOC 2 report. SOC 2 is an audit by an outside firm, and Rockbeach is a one-person company that has not yet commissioned one. If your institution requires it before a paid agreement, say so early and we will talk about timing honestly rather than pretend.
No independent penetration test to date, and no third-party accessibility audit — see accessibility.
We can complete a HECVAT on request, and would rather answer a standard questionnaire than a bespoke one.
Reporting a vulnerability
Write to security@rockbeachcurrents.com with enough detail to reproduce it. You will get a human reply within one business day. We will not threaten anybody who reports a problem in good faith.