Security Practices

Current safeguards

• Encrypted HTTPS connections for production services and restricted production administration.
• Role-, organization-, campus-, course-, and enrollment-scoped access controls for school workflows.
• Protected password storage, session controls, login protections, administrative audit records, and security-event logging.
• Automated database backups with restore verification and documented production recovery procedures.
• Central account, roster, and connected-application controls designed to keep app access aligned with district-authorized classes.
• Dependency, migration, contract, and production smoke checks in the release process.

Data-use boundaries

OrderlyClass does not sell student data, use it for targeted advertising, or use school data to train general-purpose artificial intelligence models.

Current AI-help tools prepare text for a teacher to copy into a separately approved service; OrderlyClass does not transmit those prompts to an AI provider. Direct hosted AI remains off unless it is separately reviewed and activated.

Assessment status

Security controls are reviewed through automated testing and operational checks. OrderlyClass does not currently claim SOC 2 certification, a completed independent penetration test, or another third-party security certification. District-specific evidence and commitments are provided through the applicable review and agreement process.

Report a concern

Report a suspected vulnerability, unauthorized access, or security incident to support@orderlyclass.com. Include the affected page or service, what happened, and a safe way to contact you. Do not send passwords, access tokens, or sensitive student records in the initial message.