Security

1. Where we are today

Main Office Works is a small company. This page says in plain words what is in place today and what is not. We do not hold any security certification, such as SOC 2 or ISO 27001, and we do not claim one.

For how we handle school information, see the Privacy notice.

2. Protecting the connection

• People reach the service over encrypted connections (HTTPS). Browsers are told to keep using HTTPS for a year.
• Our pages cannot be placed inside another website’s frame.

3. Signing in

• Each staff member signs in with their own email address and password.
• District and platform administrators also type a 6-digit code from an authenticator app on their phone each time they sign in. Other staff can turn this on from their profile. One-time recovery codes cover a lost phone.
• Passwords must be at least 12 characters. We store only a scrambled form of each password (hashed with scrypt), so we cannot read it.
• Five wrong passwords in a row lock a staff account for 15 minutes. Platform administrator accounts are not locked this way, because a password alone never signs them in: they also need their authenticator code.
• Signing out ends the session on our servers, not only in the browser. A session lasts up to 7 days.

4. Who can see what

• Access depends on a person’s role and school. Permissions are checked on our servers, not only on the screen.
• Records of key administrative actions are kept, such as sign-in attempts, role changes and imports.
• Each time a signed-in person opens a student’s record on one of the main student screens, we keep who looked, which student and when, but not the student’s name. Only platform administrators, and a district’s own administrators for that district’s students, can see these records. The application cannot change them, and cannot delete them for 3 years, except when a district’s data is deleted at its request. Lists of many students and barcode-scanner lookups are not included yet.

5. Stored information

Our database provider states that stored data and its backups are encrypted. We rely on that statement and have not tested it ourselves. School information is kept with service providers; see Service providers.

6. How we change the service

Before we release a change, we run an automated test suite that includes checks on school separation and access. The tests run on a made-up database with fictional students and staff.

7. Not in place yet

• We hold no security certification or independent audit report to share.
• There is no self-service tool for a district to download or delete all of its data. We do it by hand with the school’s authorized contact. See Data requests.

8. If something goes wrong

We notify districts of a security incident as required by the district’s signed agreement and New Jersey law.

To report a security problem, email hello@mainofficeworks.com with “Security” in the subject. Please do not put student or staff details in the message.