Security & Trust
Your data — and the children you serve — protected.
Nonprofits trust KidsCircle with sensitive information. Here’s how we protect it. For full detail, see our Privacy Policy, Data Processing Agreement, and Sub-processor list.
Encryption in transit
All traffic to and from KidsCircle is served over HTTPS/TLS, and data at rest is encrypted by our infrastructure providers.
Role-based access & tenant isolation
Every request is scoped to your organization and checked against roles (Admin, Field, Viewer) with server-side authorization, so one organization can never see another's data. The database also has row-level security enabled as a deny-by-default backstop.
Passwordless sign-in
We use secure magic-link authentication, so there are no passwords for us to store or for attackers to steal.
Reputable infrastructure
KidsCircle runs on established providers — application hosting, database, file storage, email, and payments — each maintaining its own security program. Card data is handled by Stripe; we never store full card numbers.
Written information security program
We maintain a documented security program covering access control, encryption, least-privilege, vendor review, logging, and regular backups, reviewed periodically.
Breach response
We have an incident and breach-response plan with defined roles and notification timelines, so if something goes wrong we act quickly and tell affected organizations without undue delay.
Careful handling of children's records
Children are not users of the platform. Organizations own and manage their own child and staff records, access is limited to their team, and we apply data-minimization and retention limits. Misuse of personal data is taken seriously.
Data retention & deletion
We keep data only as long as needed to provide the service and meet legal obligations, and we delete or de-identify it on a defined schedule after an account ends.
We don't sell your data
We never sell personal information and never use your data for advertising. We use it only to provide the service, as described in our Privacy Policy.