1. Security Approach
EduOnTrack applies data minimization, scoped access, authenticated service requests, operational logging, and defined deletion practices to DeviceOnTrack and ClassOnTrack. Security controls are selected based on the data and function involved, with additional restrictions for school-controlled student, classroom, device, snapshot, and location information.
2. Hosting and Data Architecture
Production services use managed infrastructure providers identified on the Service Providers and External Services page. DeviceOnTrack stores organization-scoped fleet and location information in its production database. ClassOnTrack stores teacher, organization, session, participant, and billing records in its production database and keeps requested snapshots in private object storage. Public website content is separated from authenticated application data.
3. Authentication and Access Control
- DeviceOnTrack administrator access requires an authenticated Firebase account and a separate approved-user record for the applicable organization.
- DeviceOnTrack applies organization and role scoping to administrator and viewer functions and provides customer-controlled support access where available.
- ClassOnTrack teachers authenticate through Supabase with email/password or optional Google sign-in.
- ClassOnTrack uses server-side authorization, database row-level controls, organization roles, and protected administrator roles.
- Administrative credentials, service keys, payment keys, and signing secrets are stored as deployment secrets rather than committed to public source files.
4. Managed Extension Security
DeviceOnTrack uses district-provided managed policy, signed enrollment and device tokens, refresh-token rotation, and organization binding to connect a managed Chromebook to the correct fleet. ClassOnTrack Enterprise requires an active classroom participant, enterprise entitlement, and a short-lived credential scoped to one participant and session before accepting extension telemetry or snapshots.
Executable extension code is packaged with the extension rather than downloaded as remote executable code. Extension network requests use HTTPS and are limited to the product endpoints and functions described in the applicable privacy policy.
5. Transmission and Storage Protection
Production web, API, authentication, billing, email, and extension traffic uses encrypted HTTPS transport. Production providers apply their managed storage and infrastructure security controls. ClassOnTrack snapshot storage is private and retrieved only through authorized application requests. Passwords are handled by the authentication provider and are not stored by EduOnTrack in plain text.
6. Data Minimization and Separation
DeviceOnTrack does not require browsing history or page content to provide fleet tracking. ClassOnTrack student participation normally uses a session code and display name rather than a permanent student account. Product permissions and stored fields are limited to the active workflow described in each product's privacy policy. Organization identifiers, role checks, scoped tokens, and database policies are used to prevent one customer from intentionally accessing another customer's records.
7. Application and Request Protection
- Request validation and server-side authorization are applied to sensitive application actions.
- Rate limiting protects login, join, billing, extension, and other abuse-sensitive endpoints.
- Stripe webhook events use signature verification and idempotency records before billing access is changed.
- Classroom join capacity uses an atomic database operation to reduce concurrent over-enrollment.
- DeviceOnTrack uses one-way hashes for selected device or connection identifiers where the original value is unnecessary.
- Error-monitoring configurations are designed to avoid default collection of personally identifying information where supported.
8. Logging, Monitoring, and Support Access
The services create audit, security, request, and error records needed to detect abuse, troubleshoot failures, and investigate incidents. Access is limited to authorized personnel with an operational need. DeviceOnTrack customer audit and location-history periods are configurable within the ranges stated in its Privacy Policy. EduOnTrack does not routinely browse classroom snapshots, participant activity, or device location for unrelated purposes.
9. Development and Deployment
Changes are maintained in version control and are subject to automated build, type, lint, test, dependency, and deployment checks appropriate to the affected project. Production configuration and secrets are kept outside ordinary source code. Dependency advisories and provider security notices are reviewed and material updates are prioritized according to risk.
10. Incident Response
EduOnTrack's incident process is designed to identify and validate an event, contain affected access, preserve reasonably available evidence, determine the affected products and data, remediate the cause, document corrective action, and notify affected customers as required by law or contract. The School Student Data Privacy Addendum contains the contractual school-notification commitment.
11. Retention, Deletion, and Recovery
Product-specific retention limits reduce unnecessary historical student, classroom, location, and audit data. Deletion controls remove active records when devices, sessions, or accounts are deleted. Provider backups support recovery from service failures and are isolated from ordinary use after production deletion until overwritten under provider backup cycles. Exact schedules are published in the product privacy policies and School Student Data Privacy Addendum.
12. Customer Security Responsibilities
- Approve only personnel who need administrative or teacher access and remove access promptly when roles change.
- Protect Google Workspace policy, enrollment tokens, account credentials, join codes, and exported files.
- Use managed organizational units and pilot deployment before district-wide extension rollout.
- Select location, snapshot, support-access, and retention settings appropriate for district policy.
- Report suspected unauthorized access promptly and preserve relevant details.
13. Reporting a Security Concern
Report a suspected vulnerability, unauthorized access, or security incident to privacy@eduontrack.com. Include the affected product, a description of the issue, steps to reproduce when safe, and contact information for coordinated follow-up. Do not access, alter, or download another customer's data while testing a concern.