Security & privacy
Built for the most sensitive records a school keeps.
Threat assessment files contain interviews, family circumstances, and a team's judgments about a child. VeriThreat is designed around least privilege, data minimization, and a complete record of who accessed what.
Least privilege
Everyone sees exactly what their role requires.
Access is enforced on the server for every page, action, and file download. Hiding a button is never the security boundary.
| Role | Can access | Cannot access |
|---|---|---|
| Staff & teachers | Submit reports; see status of their own reports | Cases, notes, other reports, other schools' students |
| BTAM member | Reports, cases, notes, assessments for their school(s) | Finalizing assessments; closing cases |
| BTAM lead | Everything a member can, plus finalize, close, reopen | Schools outside their scope |
| District admin | Users, schools, roster sync, audit log | Any student, report, or case record |
| VeriThreat staff | Account setup and support; usage counts (schools, users, reports) | Any student, report, case, note, or attachment |
Every district is its own separate account. Within it, team members can be scoped to a single school or work district-wide.
Isolation & hosting
Your district's records stay yours.
Threat assessment data shouldn't be one misconfiguration away from another district, or from your vendor. VeriThreat is built so that it isn't.
Walled off from every other district
Each district is a separate account. Every query for students, reports, and cases is limited to the signed-in user's district, and enforced on the server, not in the browser.
Even our staff can't look
VeriThreat's own team manages accounts and sees usage counts only: how many schools, users, and reports. We can't open a student, report, case, or note.
Tested before every release
Automated tests run on every change before it reaches production, including tests that try to reach one district's data from another and confirm they're refused.
Hosted in the United States
Data is stored on Google Cloud in the US (Iowa) and encrypted in transit and at rest. When AI is turned on, requests go to Anthropic with students pseudonymized first.
Backups and recovery
Automatic daily backups kept for 14 days, point-in-time recovery, and deletion protection on the database.
Access ends when someone leaves
When a staff member leaves, your district admin deactivates their account and every session they have ends immediately. Role changes take effect the same way.
Safeguards
Protection at every layer.
Audit log of every access
Views of students, reports, cases, assessments, and attachments are recorded with the user, time, and IP address, along with logins and every change. Administrators can search it by action or record.
No demographic data
VeriThreat doesn't store race, ethnicity, religion, disability, IEP/504 status, or income, and never requests them from your SIS. Data that isn't collected can't leak or bias a decision.
Pseudonymized AI requests
When AI is used, students are replaced with labels, known names are removed from free text, and identifiers are left out. AI can be disabled entirely.
Hardened authentication
Passwords hashed with bcrypt, session tokens stored only as hashes, HTTP-only cookies, and sessions that expire after a school day. Deactivating a user ends their sessions immediately.
Protected evidence files
Uploads are checked against their actual contents and size, stored under random names in a private, encrypted storage bucket, served only to authorized users, and never cached.
No caching of sensitive pages
Every page is rendered fresh on the server for the signed-in user, with no-store headers, frame protection, and strict content-type handling.
Read-only roster sync
OneRoster integration uses read-only credentials and reads only names, IDs, and grades. Students are never deleted, so case history survives withdrawals and transfers.
Separation of duties
District administrators manage accounts and rosters but can't open student or case records. Only BTAM leads can finalize assessments or close cases.
Immutable decisions
Finalized assessments are locked. Reopening one requires a lead and is written to the audit log.
Compliance
Designed to support your obligations.
Student privacy law varies by state, and threat assessment records raise specific questions about access, retention, and sharing. We work with your counsel and privacy officer instead of handing you a checkbox.
Built in
- Record-of-access logging to support FERPA requirements
- Role-based access to education records by legitimate educational interest
- Data minimization for both storage and AI processing
Decided with your district
- Data processing agreements, including for AI processing
- Record retention and parent-access procedures
- Information sharing with school resource officers and law enforcement
- Account provisioning and sign-on requirements
Security documentation and deployment details are available on request.
Every attacker in the Secret Service's study showed concerning behavior first.
Make sure the people who notice it have somewhere to go, and your team has what it needs to act.