Security & Data Protection
How We Protect Student Data
The laws that govern student screening data, and the controls that enforce them.
🛡 How we protect the data
Defense in depth, aligned to the NIST Cybersecurity Framework, CIS Controls v8, and GESS.
📜 The laws we follow
MARS handles mental-health screening data for students, so it operates under the education and health privacy laws that govern that data.
FERPA — Family Educational Rights and Privacy Act
FERPA is a federal law that protects the privacy of educational records. In compliance with FERPA, MARS restricts access to users' screening results, allowing only authorized personnel within the organization to view them. Written consent from guardians is required before any personally identifiable information can be shared with third parties.
HIPAA — Health Insurance Portability and Accountability Act
We strictly adhere to HIPAA, a U.S. law establishing privacy and security standards to protect health information. Two-factor authentication is required for all staff accounts, and a signed Business Associate Agreement is in place with our hosting provider.
COPPA — Children's Online Privacy Protection Act
To comply with COPPA, we obtain verifiable parental consent before collecting any personal information from users under the age of 13. Parents also have the option to review and request the deletion of their child's information.
CSPC — California Student Privacy Certified
We follow CSPC and California Department of Education guidelines for handling personal information from users under 18 in California. Verifiable parental consent is obtained before data collection, and parents can review or delete stored information upon request.
🔐 How that is enforced
The laws above are commitments. These are the controls that hold them up:
- Encryption — all traffic uses TLS 1.2 or 1.3; sensitive data, including login credentials and screening results, is AES-256 encrypted at rest.
- Two-factor authentication — required for all staff accounts, meeting HIPAA requirements.
- Role-based access — every user has a unique login, and permissions follow the person's role. Access is reviewed regularly and revoked immediately when someone leaves.
- Restricted access — screening data is stored encrypted, and access is limited to authorized personnel within the organization.
- Backups — incremental snapshots allow full recovery to the minute, and a second copy is kept in DigitalOcean Spaces and validated after every update. Screening data, access logs and credentials are retained for six years, then securely deleted.
📚 References
The standards and infrastructure our controls are built on.
Reference | Description | Link |
DigitalOcean Trust | Hosting provider — SOC 2 Type II, ISO 27001, HIPAA BAA | |
NIST CSF | Cybersecurity Framework — Identify, Protect, Detect, Respond, Recover | |
CIS Controls v8 | 18 prioritized cybersecurity safeguards | |
Cloudflare Trust Hub | Web application firewall, DDoS protection, enforced HTTPS | |
FERPA | Family Educational Rights and Privacy Act — U.S. Dept. of Education | |
HIPAA | Health Insurance Portability and Accountability Act — U.S. HHS |