Security Practices Summary

Effective Date: [EFFECTIVE DATE] Last Updated: [LAST UPDATED] Version: 2.0

This summary describes the security measures KidStarter uses to protect the Service, User data, and — most importantly — the safety and privacy of Students. This is a summary for transparency purposes and does not constitute a guarantee of absolute security. No system is perfectly secure.

---

1. Security Architecture

1.1 Encryption

• In Transit: All data transmitted between Users and the Service is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints.
• At Rest: Personal Data and sensitive data (including verification evidence) is encrypted at rest using AES-256 or equivalent.
• Payment Data: Full payment card numbers are never transmitted to or stored by KidStarter. Payment processing is handled by PCI DSS Level 1 certified processors.

1.2 Access Controls

• Role-Based Access Control (RBAC): Access to systems, data, and administrative functions is restricted based on role and the principle of least privilege.
• Multi-Factor Authentication (MFA): Required for all administrative and moderation access.
• Segregated Access: Verification evidence and private Student data are stored in segregated, restricted-access environments.
• Audit Trails: All access to sensitive data and administrative actions are logged.

1.3 Infrastructure

• Hosted on reputable, SOC 2 Type II / ISO 27001 certified cloud infrastructure providers.
• Network segmentation and firewall rules to limit exposure.
• DDoS protection and rate limiting.
• Automated backups with tested restoration procedures.
• Disaster recovery and business continuity planning.

---

2. Application Security

• Secure software development lifecycle (SSDLC) practices;
• Code reviews with security-focused checklist;
• Dependency scanning for known vulnerabilities;
• Input validation and output encoding to prevent injection and XSS attacks;
• CSRF protection;
• Content Security Policy (CSP) headers;
• Regular security testing (see Section 4).

---

3. Employee and Contractor Security

• Background checks for employees and contractors with access to sensitive data (to the extent permitted by law);
• Mandatory security awareness training upon onboarding and annually thereafter;
• Mandatory child safety training for all staff with access to Campaign content or Student data;
• Confidentiality and data protection agreements;
• Principle of least privilege applied to all personnel;
• Prompt access revocation upon role change or departure.

---

4. Security Testing

• Vulnerability Assessments: Regular automated vulnerability scanning of infrastructure and application.
• Penetration Testing: Independent third-party penetration testing conducted at least annually, with remediation of critical and high-severity findings prioritized.
• Continuous Monitoring: Security monitoring and alerting for anomalous activity, unauthorized access attempts, and policy violations.

---

5. Vulnerability Disclosure / Responsible Disclosure

KidStarter operates a responsible disclosure program. If you discover a security vulnerability in the Service, please report it responsibly:

• Email: [SECURITY EMAIL, e.g., security@kidstarter.com]
• Please include: a description of the vulnerability, steps to reproduce, and your contact information.
• Do not access, modify, or delete data belonging to other Users.
• Do not publicly disclose the vulnerability before we have had a reasonable opportunity to investigate and remediate.

We commit to:

• Acknowledging receipt within 3 business days;
• Providing an initial assessment within 10 business days;
• Working in good faith to resolve confirmed vulnerabilities promptly;
• Not taking legal action against security researchers who act in good faith and comply with this program.

[If you operate a formal bug bounty program, include the link and program details here.]

---

6. Incident Response

KidStarter maintains documented incident response procedures. See the Incident Response & Breach Notice Summary for details.

---

7. Certifications and Compliance Roadmap

[Update this table with your actual certification status before publication.]

---

8. Third-Party Security

• All third-party service providers that process Personal Data on our behalf undergo security and privacy assessments.
• Third-party providers are bound by data processing agreements with security obligations.
• We maintain a registry of subprocessors (see DPA).

---

9. Contact

Security Issues: [SECURITY EMAIL] Privacy Inquiries: [PRIVACY EMAIL] General Support: [SUPPORT EMAIL]