Security & Trust

How we protect student and school data.

Questions? Email hello@hallwise.com

Our Data Commitments

We never sell student data

Student data is used only to provide the hall pass service. It is never sold, licensed, or monetised in any way.

No advertising, ever

We do not show ads to students or teachers. Student data is never used for advertising targeting or profiling — not by us, and not by any third-party service we use on authenticated pages.

Data used only for the service

Student names, rosters, and pass records are used solely to run the hall pass service. We do not analyse student data for any other purpose.

Student data deleted within 30 days of cancellation

When a school ends its subscription, all student data is permanently deleted within 30 days. Backup copies are purged within 90 days. Deletion on request is completed within 5 business days.

We sign DPAs on request

We support the National Data Privacy Agreement (NDPA) framework and will sign a Data Processing Agreement with any school or district that requires one.

Infrastructure & Sub-processors

Hallwise uses the following third-party services. Each is a certified provider with its own compliance programme, and none receive student data except as necessary to operate the service.

Supabase (database)

SOC 2 Type IIISO 27001:2022

All application data — student names, pass records, course rosters — is stored in Supabase PostgreSQL, hosted on AWS US East. Supabase holds SOC 2 Type II and ISO 27001:2022 certifications. Data is encrypted at rest and in transit.

Security documentation ↗

Vercel (hosting)

SOC 2 Type IIISO 27001:2022

The application is deployed on Vercel's edge network. Vercel holds SOC 2 Type II and ISO 27001:2022 certifications. All traffic is encrypted via TLS. Student data passes through Vercel in transit only — it is not stored at the CDN layer.

Security documentation ↗

Google (authentication & Classroom)

ISO 27001FERPA-aligned (Workspace for Education)

Teacher sign-in uses Google OAuth. Class roster sync uses the Google Classroom API with read-only access to courses and rosters only (no access to grades, assignments, or announcements). Google Workspace for Education is FERPA-aligned and ISO 27001 certified.

Security documentation ↗

Stripe (payments)

PCI DSS Level 1

Billing is handled entirely by Stripe. No student data is ever sent to Stripe — only the school admin's email and payment information. Credit card numbers are processed and stored exclusively by Stripe, never by us.

Security documentation ↗

Resend (email)

SOC 2 Type II

Used only for contact form auto-replies. No student data is transmitted via email. Resend holds SOC 2 Type II certification.

Security documentation ↗

FERPA & COPPA Position

FERPA

FERPA applies to schools, not vendors. Hallwise acts as a school official under FERPA's school official exception: the school contracts with us to provide the hall pass service, and we access student records only on the school's behalf and only for that purpose. We do not disclose student records to third parties without the school's authorization.

COPPA (Children Under 13)

Hallwise may be used by students under 13. We rely on the COPPA school consent exception, which permits schools to provide consent on behalf of students for services used for a narrow educational purpose. Schools using Hallwise agree (via the Terms of Service) to provide this school-consent authorization. We limit data collection to what is reasonably necessary for hall pass management and do not use student data for any commercial purpose.

State Laws

Our data practices are designed to comply with major state student privacy laws including SOPIPA (CA), SOPPA (IL), New York Ed Law 2-d, and similar laws. We do not sell student data, use it for advertising, or share it with unauthorized parties — consistent with the requirements of these laws.

Data Processing Agreements

Many districts require a signed Data Processing Agreement (DPA) before approving a vendor. We support the National Data Privacy Agreement (NDPA) — the standard DPA template maintained by the Student Data Privacy Consortium (SDPC), used by over 275,000 schools and 6,600+ vendors across the US.

How to request a DPA

  1. Email hello@hallwise.com with your district name and state
  2. We will confirm receipt within 1 business day and return a signed NDPA-compliant agreement within 3 business days

For districts using state alliance DPAs, we can execute those directly as well. Contact us with your state and district name.

Security Practices

  • Encryption in transit: All connections use TLS 1.2 or higher. HTTPS is enforced on all routes.
  • Encryption at rest: All database data is encrypted at rest by Supabase on AWS infrastructure.
  • Row-level security: Database queries are scoped by school ID at the row level. A teacher or admin at one school cannot access another school's data.
  • Minimal data collection: We only collect what is necessary to run the service. Student data is limited to names, emails, and pass records.
  • No third-party tracking on authenticated pages: Google Analytics and similar tools are blocked on all authenticated pages and the student kiosk. Student-facing pages have no external scripts beyond the app itself.
  • Minimal OAuth scopes: We request read-only access to Google Classroom courses and rosters only. We do not request access to grades, announcements, submissions, or any other Classroom data.
  • Production access controls: Production database access is restricted to the application service account and the service owner. No third-party staff has access to production student data.

Security Vulnerability Reporting

If you discover a security vulnerability in Hallwise, please disclose it responsibly by emailing hello@hallwise.com. We will acknowledge receipt within 24 hours and work to resolve confirmed issues promptly.