Trust & Security
Built to protect teachers and their students.
Sandbox handles classroom information, so security and privacy are part of how the product is built, not an afterthought. This page explains what we do today and what we are still working on.
Where we are today. Sandbox is an early-stage product running a teacher pilot. We are transparent about what is in place and what is still being built, and we do not claim certifications we have not earned. If your school needs something specific for its review, reach out and we will walk you through it.
How we protect data
Security built into the product
Student data kept apart
Real student records live in a separate, isolated database with stricter access rules than the rest of the Service. During our pilot, teachers are asked to use mock data only.
Encrypted in transit and at rest
All data moves over encrypted connections (TLS), and data stored on our infrastructure is encrypted at rest by Google Cloud.
Access control and audit logs
Only the authorized teacher can reach the records they create. Access to student records is logged, and inactive sessions time out automatically.
Never sold, never used for ads
We do not sell personal information and never use student information for advertising. Material you attach to the assistant never includes student records.
Compliance and frameworks
The standards we work to
FERPA
AlignedWe handle student education records as a “school official” under the U.S. Family Educational Rights and Privacy Act, under the direct control of the school.
COPPA
SupportedSandbox is a tool for teachers, not for children directly. Where the U.S. Children’s Online Privacy Protection Act applies, schools provide consent for the educational use of student information.
PIPEDA and provincial law
AlignedAs a Canadian company, we follow the federal Personal Information Protection and Electronic Documents Act and applicable provincial privacy laws.
SOC 2
On our roadmapWe are building the controls and monitoring needed for a SOC 2 examination as we grow beyond the pilot. We will publish the report here once it is complete.
How we handle your data
Clear and limited by design
- We collect only what is needed to run the Service and power the features you use.
- Student records are entered by authorized teachers, kept in an isolated database, and never sent to AI features.
- We do not sell personal information and do not use student data for advertising.
- You can export the content you create and close your account from your data and privacy settings.
- If a breach affects your data, we notify you and the affected school without unreasonable delay.
Full detail is in our Privacy Policy and FERPA Notice.
Who we work with
Subprocessors
These providers process data on our behalf to run the Service, under agreements that limit their use of it to that purpose.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, and authentication | United States and global |
| AI service providers | Generating and editing content in AI features | United States |
| Stripe | Payment processing (planned, for future paid tiers) | United States and global |
| Email delivery provider | Account and notification emails | United States |
Reporting a concern
Responsible disclosure
If you believe you have found a security issue, please tell us before sharing it publicly. We will acknowledge your report, investigate, and keep you updated. We appreciate the researchers and teachers who help keep Sandbox safe.
Email security@sandboxlearn.comQuestions from your school or board?
We are happy to walk your team through how Sandbox handles student data.