CLASSPAL SECURITY POLICY

Effective Date: August 3, 2026
Last Updated: August 3, 2026

1. Introduction

Welcome to ClassPal, a digital education improvement ecosystem owned and operated by Digjy LLC (“ClassPal,” “Company,” “we,” “our,” or “us”).

Protecting the confidentiality, integrity, and availability of our systems and the personal information entrusted to us is one of our highest priorities.

This Security Policy describes the administrative, technical, and organizational safeguards we use to protect:

Student information
Parent information
School information
Educational records
Artificial intelligence services
User accounts
Platform infrastructure
Digital assets
ClassPal services

This Security Policy should be read together with our:

Terms of Service
Privacy Policy
Student Data Privacy Policy
Cookie Policy
Acceptable Use Policy
Responsible AI Policy

2. Security Principles

ClassPal’s security program is built upon the following principles:

Confidentiality
Integrity
Availability
Privacy by Design
Security by Design
Least Privilege
Defense in Depth
Secure Development
Continuous Improvement
Regulatory Compliance
Risk Management

Security is incorporated throughout the design, development, deployment, and operation of the Platform.

3. Scope

This Security Policy applies to:

The ClassPal website
Student accounts
Parent accounts
School accounts
Artificial intelligence services
APIs
Administrative systems
Cloud infrastructure
Mobile applications (if available)
Future ClassPal products and services

It applies to all users, employees, contractors, vendors, and service providers with authorized access to ClassPal systems.

4. Information We Protect

We protect information including:

Personal information
Student records
Parent information
School information
Authentication credentials
Account settings
Educational content
Assignments
Assessment data
AI interactions
Uploaded files
Communication records
Platform logs
Security logs
Administrative data

Protection measures are applied based on the sensitivity and purpose of the information.

5. Security Governance

Digjy LLC maintains a security program designed to:

Identify risks.
Assess threats.
Implement safeguards.
Monitor security.
Respond to incidents.
Improve security practices.
Promote compliance with applicable laws and contractual obligations.

Security responsibilities are assigned to appropriate personnel and reviewed periodically.

6. Access Control

Access to ClassPal systems is restricted according to business need and job responsibilities.

Security controls may include:

Role-based access control (RBAC)
Least privilege access
Administrative approval for privileged access
Access reviews
Secure authentication
Session management
Account lifecycle management

Access permissions are reviewed and updated as roles or responsibilities change.

7. Authentication

To protect user accounts, ClassPal may implement:

Secure password requirements
Password hashing using industry-accepted algorithms
Multi-factor authentication (MFA) for administrative accounts and, where available, user accounts
Login attempt monitoring
Account lockout or rate limiting after repeated failed authentication attempts
Secure password reset processes
Session timeout controls

Users are responsible for maintaining the confidentiality of their account credentials.

8. Encryption

ClassPal uses encryption to help protect information.

Security measures may include:

Data in Transit

HTTPS
TLS encryption
Secure API communications

Data at Rest

Where appropriate based on the sensitivity of the information and system architecture, sensitive data may be encrypted while stored using industry-standard cryptographic methods.

Encryption key management practices are designed to reduce unauthorized access to encrypted information.

9. Network Security

To protect our infrastructure, we may use:

Firewalls
Network segmentation
Traffic filtering
Secure cloud networking
Intrusion detection systems
Intrusion prevention systems
Rate limiting
DDoS mitigation services
Secure VPN access for authorized administrative activities, where applicable

Network controls are reviewed and updated as needed.

10. Application Security

ClassPal incorporates secure development practices throughout the software development lifecycle.

These practices may include:

Secure coding standards
Code reviews
Dependency management
Vulnerability scanning
Security testing
Patch management
Secure configuration management
Change management procedures

Security issues are prioritized based on risk and addressed through established development and operational processes.

11. Artificial Intelligence Security

Because ClassPal includes AI-powered educational features, additional safeguards may include:

Prompt filtering
Abuse detection
Content safety controls
Rate limiting
Input validation
Output monitoring
Logging for security purposes
Model access controls
API authentication
Monitoring for unusual usage patterns

AI safeguards are intended to support secure and responsible use of AI features.

12. Monitoring & Logging

To maintain Platform security, we may monitor:

Authentication events
Administrative actions
System performance
Security alerts
Error logs
API activity
Network activity
Infrastructure health
Platform availability

Monitoring is performed to:

Detect unauthorized access.
Investigate security incidents.
Improve Platform reliability.
Prevent abuse.
Maintain operational integrity.

Log access is restricted to authorized personnel and retained in accordance with operational and legal requirements.

13. Vulnerability Management

We maintain processes designed to identify and address security vulnerabilities.

These processes may include:

Routine vulnerability scanning
Security assessments
Dependency reviews
Patch management
Risk prioritization
Configuration reviews
Remediation tracking

Critical issues are prioritized based on their potential impact to users and the Platform.

14. Security Incident Response

If we become aware of a security incident, we maintain procedures designed to:

Assess the incident.
Contain the impact.
Preserve relevant evidence.
Investigate the cause.
Restore affected services.
Implement corrective measures.
Meet applicable legal notification requirements.

Where required by applicable law, affected individuals, schools, regulators, or other appropriate parties will be notified within legally required timeframes.

15. Business Continuity & Disaster Recovery

To support service resilience, ClassPal maintains business continuity and disaster recovery measures that may include:

Secure data backups
Redundant infrastructure where appropriate
Recovery procedures
Disaster recovery planning
Incident response coordination
Periodic testing of recovery processes

Recovery objectives may vary depending on the affected systems and operational requirements.

16. Employee Security

Employees and authorized contractors with access to ClassPal systems are expected to:

Follow security policies.
Protect confidential information.
Use secure authentication practices.
Report suspected security incidents promptly.
Complete security awareness training where applicable.
Access information only as required for authorized business purposes.

Access is limited according to job responsibilities and may be revoked promptly when no longer required.

17. Third-Party Security

ClassPal works with third-party providers that support services such as:

Cloud hosting
Authentication
Artificial intelligence
Payment processing
Email delivery
Analytics
Customer support

We seek to work with providers that maintain appropriate security controls for the services they perform.

Third-party providers are expected to protect information they process on our behalf in accordance with applicable contractual obligations and legal requirements.

18. User Responsibilities

Users play an important role in maintaining account security.

Users should:

Create strong passwords.
Keep passwords confidential.
Enable available multi-factor authentication.
Keep devices updated.
Use trusted networks.
Log out of shared devices.
Report suspicious activity promptly.
Protect personal information.

Users are responsible for activity occurring under their accounts unless otherwise provided by applicable law.

19. Security Reporting

If you believe you have discovered a security vulnerability or incident involving ClassPal, please notify us promptly.

Please include, where available:

A description of the issue.
The affected feature or system.
Steps to reproduce the issue, if applicable.
Screenshots or supporting information.
Contact information for follow-up.

We request that security researchers act responsibly and avoid actions that could harm users, compromise data, or disrupt Platform operations.

20. Compliance

ClassPal is designed to support compliance with applicable legal and contractual obligations, including, where applicable:

Family Educational Rights and Privacy Act (FERPA)
Children’s Online Privacy Protection Act (COPPA)
California Consumer Privacy Act (CCPA)
California Privacy Rights Act (CPRA)
Other applicable U.S. privacy and security laws

Compliance obligations may vary depending on how the Platform is used and any agreements with participating educational institutions.

21. Changes to This Security Policy

We may update this Security Policy from time to time to reflect:

Changes in technology
Security improvements
New Platform features
Legal or regulatory requirements
Industry best practices
Operational changes

When material changes are made, we will update the Last Updated date and provide notice where required by applicable law.

22. Contact Information

If you have questions regarding this Security Policy or wish to report a security concern, please contact:

Digjy LLC
ClassPal Security Office

Website: https://classpal.digjy.xyz (update if your production domain changes)

Email: contact@classpal.digjy.xyz (or replace with a dedicated security email such as security@classpal.digjy.xyz if you create one)

You may contact us regarding:

Security vulnerabilities
Security incidents
Account security
Data protection
Responsible disclosure
Privacy and security questions
Compliance inquiries

23. Final Statement

Digjy LLC is committed to maintaining a secure educational platform through layered security controls, responsible operational practices, and continuous improvement. While no technology can eliminate every risk, we continually evaluate and enhance our security program to protect students, parents, schools, educational data, and the ClassPal platform against evolving threats.