Security and privacy answers
Our answers to the questions a school's IT or procurement office usually asks, set out like the EDUCAUSE HECVAT Lite. Every answer describes what the service does today. Where something is not in place, we say No or Planned.
Covers: the Hall Pass study guides on headedin.com, the Hall Pass phone apps and the Class Board (headedin.com/class). From Headed In LLC, a Florida limited liability company in St. Petersburg, Florida. Last reviewed November 11, 2026. Questions: hello@headedin.com.
Yes in place today
Partly some of it
Planned not yet; we mean to
No not in place
N/A doesn't apply
The short version
Students don't need an account. To join a class board a student types the class code and a first name or nickname. The board stores that name and study progress summaries (readiness score, topic strengths, last day studied), never answers to single questions, and no email, student ID, birthday or address. Data is held by Supabase on Amazon Web Services in Northern Virginia, USA, encrypted in transit and at rest. A teacher can delete a board, or any student on it, at once. We don't sell data, show ads or use tracking cookies.
Not in place yet: an outside audit (SOC 2) or penetration test, single sign-on, teacher logins with two-factor, database backups, a written security policy and an uptime guarantee.
1. Company and contacts
| Legal name and type | Answer Headed In LLC, a Florida limited liability company (St. Petersburg, Florida), formed in 2026. |
|---|---|
| Products covered | Answer Hall Pass study guides (headedin.com, iPhone and Android apps) and the Class Board teacher view (headedin.com/class). |
| Security and privacy contact | Answer hello@headedin.com. |
| Dedicated security staff or officer | No We are a small company. The managing member is responsible for security and privacy. |
| Cyber liability insurance | No |
| Any data breach in the past | None We have had no known breach of student or user data. |
2. Audits, policies and documents
| SOC 2, ISO 27001 or similar audit of our company | No Our hosting vendors hold their own: Cloudflare (SOC 2 Type II, ISO 27001), Supabase (SOC 2 Type 2) and Stripe (PCI DSS Level 1). |
|---|---|
| Third-party penetration test | No |
| Written information security policy | Planned These answers are our current written description of how the service is secured. |
| Written incident response plan | Partly No formal plan document yet. Our commitment: if we confirm an incident that affects a school's data, we tell the school's contact without undue delay and within 72 hours, say what happened and what we did, and give the notices Florida law (s. 501.171, F.S.) requires. |
| Business continuity or disaster recovery plan | No The website files are served from Cloudflare's worldwide network. The class data lives in one Supabase database. See Backups below. |
| Accessibility (VPAT or self-review) | Partly A WCAG 2.1 AA self-review, with the gaps we found: accessibility statement. No third-party audit. |
| Privacy policy | Yes headedin.com/privacy#study lists every field the study guides and class boards send. |
| Will you sign our data privacy agreement (DPA) or FERPA addendum? | Yes Send it to hello@headedin.com. We review it and sign where it matches how the service works. |
3. What data we keep
| Student data on a class board | Answer The first name or nickname the student types; for each guide they open: readiness score (Pass Meter), expected score, ready date, answer and mastered counts, last practice test score, score by topic, up to five most-missed topic codes (never which questions), last day studied, whether they passed the real exam (if they say), progress on a class assignment; and a random code their browser makes up so each student counts once. |
|---|---|
| What we never collect from students | Answer No email (unless the student chooses "Keep a copy with my email", separate from the board), no password, student ID, birthday, address, phone, photo or grades from your systems. Answers to single questions stay in the student's own browser or phone. |
| Teacher data | Answer The class name the teacher types. Teachers have no account and give us no name or email unless they write to us. |
| Students under 13 | N/A Class boards are for students 13 and older. We don't knowingly collect data from children under 13. |
| Health information (HIPAA) | N/A The service holds no protected health information. Patients in nursing and EMS practice questions are made up. |
| Card payments (PCI) | N/A We never see card numbers. Single-guide unlocks bought by a student are paid on Stripe's own checkout. School plans are invoiced. |
| Do you sell data, show ads or use it for marketing? | No Never sold, never shared for ads. No advertising or tracking cookies on the study guides or class boards. Page visits are counted with Cloudflare Web Analytics, which sets no cookies and keeps no IP address. |
| Is student data used to train AI? | No Class board data never goes to an AI service. The optional "Coach me" study helper (web guides only) sends the questions a student missed and our explanations to Anthropic, with no name, email or code that identifies the student; Anthropic does not train on it. A student can turn the coach off; there is no school-wide off switch yet. |
| Who owns the data | Answer The school and its students. We use it only to run the board and to show anonymous totals (for example, how often students at each Pass Meter reading pass, only for groups of 10 or more). |
4. Where data lives and how it's protected
| Data location | Answer United States. The database is Supabase (PostgreSQL) on Amazon Web Services, US East (Northern Virginia). Website files, which hold no student data, are served by Cloudflare. |
|---|---|
| Encryption in transit | Yes HTTPS only; plain HTTP is redirected to HTTPS. Connections use TLS 1.3 with modern browsers. |
| HSTS and a minimum of TLS 1.2 enforced at the edge | Planned |
| Encryption at rest | Yes Provided by Supabase on AWS (AES-256 disk encryption). |
| Access control in the database | Yes Row-level security is on for every class table and all direct access by the public is revoked. Every read and write goes through our server function, which checks the teacher key or class code and validates each field. |
| Can one student see another's data? | No A student's browser only ever sends its own progress. Only the teacher link shows the class. |
| Staff access to production data | Answer Only the company's managing member, through the Supabase and Cloudflare dashboards. No contractors or outside staff have access. |
| Two-factor login on those admin accounts, confirmed and documented | Planned |
| Backups | No Our current database plan has no backups we can restore. A deleted board is gone for good. We plan to move to a plan with daily backups once school plans start. |
| Uptime guarantee (SLA) | No Study progress is saved on the student's own device first, so a short outage doesn't lose work. |
5. Sign-in and access to a board
| How teachers sign in | Answer No account. Starting a board gives the teacher a private link that holds a 128-bit random key. Anyone with the link can see and manage that board, so treat it like a password. The key sits after the # in the link, so browsers don't send it to servers or in referrer headers. |
|---|---|
| How students join | Answer A 6-character class code plus a first name or nickname. The code lets a student join and add their own progress; it can't show the board. |
| Single sign-on (SAML, Google, Microsoft), LMS or LTI integration | No |
| Two-factor login for teachers | No Teachers have no accounts, so there is nothing to add it to yet. |
| Can a lost teacher link be replaced? | Partly Email us from the school and we can help. A teacher can delete a board and start a new one at any time; students join again with the new code. |
| Limits on repeated tries | Yes Per-address rate limits on joining, syncing and viewing, sized so a whole class on one school network still works. |
6. Keeping and deleting data
| Can the school delete its data? | Yes "Delete the board" on the teacher view deletes the board and every student row at once. The teacher can also remove one student. |
|---|---|
| Can a student delete their own data? | Yes "Leave" on any guide deletes their rows right away; "Erase what this browser sent" on our privacy page deletes everything that browser ever sent. In the apps: "Erase my class data". |
| Automatic deletion | Yes A board nobody opens or studies on for 180 days is deleted with everything on it. |
| Deletion at the end of a contract | Yes On written request we delete the school's boards within 30 days and confirm by email. Usually it's same day. |
| Data returned at the end of a contract | Partly The teacher view prints; we can also email a spreadsheet of a board's progress summaries on request. |
| Request logs and IP addresses | Answer We store no IP addresses in our database. Our hosting providers keep short-lived request logs for running the service. |
7. Building and running the software
| Changes tested before release | Yes Scripted end-to-end checks run against the live class board service (start a board, join, sync, assign, remove, delete), and every change to what is sent is checked against the privacy page before release. |
|---|---|
| Second-person code review | No |
| Separate test environment | Partly Website changes can go to a private preview address first. The database has one production copy. |
| Input checking and safe display of what students type | Yes Fields are checked for type and length on the server; names are escaped before they are shown. |
| Content Security Policy header | Planned |
| Automated vulnerability scanning | No The service is mostly static pages plus one small server function, with few outside code libraries. |
| Outside vendors that handle data (subprocessors) | Answer Supabase (database and server functions), Cloudflare (website hosting, visit counts), Resend (only the 6-digit sign-in email for students who choose "Keep a copy with my email"), Anthropic (only the optional study coach; question text, no student identity), Stripe (only for card payments), Apple and Google (app stores). |
8. Buying
| Price | Answer $5 per student per month, only the months your class runs; or $299 a year for a whole program, up to 100 students. Free boards hold 10 students. |
|---|---|
| Invoice, purchase order and W-9 | Yes We send an invoice and a signed W-9; purchase orders are welcome. Payment by check or bank transfer (ACH), due 30 days from the invoice. |
| Do students ever pay? | No On a school-plan board every student gets every practice test free while the plan runs. |
Something here doesn't match what you need, or your form asks it differently? Send us your questionnaire at hello@headedin.com and we'll fill it in with these answers. Back to For schools.