Student data, handled with care

How Moosey keeps student and family information safe, written for the people at your district who will ask.

Who can see what

Every request is checked against the person’s role and school before any data is returned.
Each school’s and district’s data is kept separate at the query level, and every route was audited for it.
Families only see information about their own children.

Database protection

Row-level security is turned on for every table, as a second layer behind the app’s own checks.
Most tables deny all direct access, so data can only be reached through the checked API.
The public app key has no access to any table.

Encryption

All connections are encrypted in transit, and all stored data is encrypted at rest.
Health, allergy, and safety-report details get their own AES-256-GCM field encryption, with tamper detection.
Integration credentials, such as SIS connection secrets, are encrypted too.

Files and photos

Photos and attachments are stored privately, never at a public address.
Each file is shared through its own link that expires after one hour.

Signing in

Staff can sign in with Google, Microsoft, or your SAML provider.
Students sign in without an email address, and staff can turn a student’s login off and back on.
The mobile apps keep sign-in tokens in the phone’s secure storage.
Sign-in and other public pages are rate-limited to slow down guessing attacks.

AI features

AI tools help teachers draft plans, newsletters, and leveled materials.
Student names and personal details are not sent to the AI provider. Class summaries use rounded ranges, so no one student can be singled out.

Accountability

An audit log records who made each change, when, and from where, and admins can search it.
We keep a written security checklist and re-check it as the product changes.

Privacy by default

No ads, ever.
Pages don’t load fonts or scripts from other companies’ servers.

Reviewing Moosey for your district?

We’re glad to walk your technology and privacy team through how data is stored and who can reach it, and to answer your questions about student privacy laws.