Skip to main content
SchoolBoardHQ
Security
Effective September 7, 2026 · Last updated September 7, 2026
How SchoolBoardHQ protects your account and data.
How your account is protected
Your password is never stored in plain text or in a reversible ("encrypted") form. Our authentication provider, Supabase Auth, stores a bcrypt hash of your password — a one-way transformation that cannot be decrypted back into your original password, even by us.
Controls you manage yourself
Everything else on this page describes protections that apply to every account automatically — there is nothing for you to switch on. The security settings you do control for your own account are in the app, under Settings → Privacy → Security. That is where you review the members you have blocked and choose whether other members can find and contact you in the member directory. Your password itself is changed under Settings → Account & identity → Email & password.
Data protection in our database
Every table in our database has row-level security rules that scope what a signed-in user can read or write to their own data and whatever else our visibility rules explicitly allow (for example, a district-mate seeing your board role). Privileged operations — claiming a board seat, an admin approving a manual review — run through dedicated server-side functions rather than a raw database write a client could tamper with. We maintain an automated test suite that exercises these access rules directly against our database.
Data in transit
All traffic between the app and our backend is encrypted in transit (TLS), via our backend provider Supabase's infrastructure.
Third parties
These are the only service providers with access to any of your data.
Service providers we use and what they receive
Supabase
Purpose
Backend database, authentication (including optional sign-in with Google, LinkedIn, or Apple, and optional two-factor authentication), and file storage
Data shared
Account and directory data, uploaded documents, and — if you choose to use them — the identity your sign-in provider shares and your two-factor authentication secret
Retention
For as long as your account is active
Anthropic
Purpose
AI-assisted features: drafting text on your behalf, summarizing and organizing material you already have, finding your board's published information, and answering your questions
Data shared
Only the specific input a feature needs — see AI-assisted features below
Retention
Governed by Anthropic's API terms; not used to train its models
PostHog
Purpose
Usage analytics and feature-flag targeting, tied to your account ID
Data shared
Your account ID, feature-flag evaluation requests, and feature-usage events — not their content
Retention
Per PostHog's standard analytics retention
Sentry
Purpose
Crash and performance diagnostics, so we can find and fix errors in the app
Data shared
Error and performance reports from the app. Names, email addresses, message and post text, document contents and similar personal fields are removed on your device before a report is sent — and so are the internal ids of the records involved, so a report cannot be traced back to your account
Retention
Per Sentry's standard error-reporting retention
Resend
Purpose
Sending transactional email — verification codes and notification digests
Data shared
The email address a message is sent to, and the contents of that message
Retention
Per Resend's standard email-delivery retention
Expo
Purpose
Delivering push notifications to your device, if you allow them
Data shared
Your device's notification token, and the notification itself — which includes the name of the member who prompted it and, for a reply to something you posted, the text of that reply. A new-message notification deliberately carries only the sender’s name, never the message
Retention
For as long as the notification is in transit; tokens are removed when you sign out
Certifications
SchoolBoardHQ has not pursued formal third-party security certification (such as SOC 2 or ISO 27001) at this stage. Our security practices are described above and are open to review on request.
Responsible disclosure
If you believe you have found a security problem in SchoolBoardHQ — a way to read or change data that is not yours, to act as another member, or to get past a check the app is supposed to make — email support@schoolboardhq.com. Please tell us privately first, before describing the problem publicly, so members are not exposed while we are still fixing it.
A report we can act on usually includes:
•
What you were doing, and the screen or web address where you were doing it.
•
What happened, and what you expected to happen instead.
•
The steps someone else would follow to see the same thing.
•
Roughly when it happened, and the device, operating system, and app or browser version you used.
•
Whether you think anyone else’s data was reachable, and roughly how much — described, not attached.
Please do not send us another member’s personal information, anyone’s password, or confidential district, student, or personnel information as evidence. Describing what you were able to reach is enough for us to reproduce it.
What you can expect back: a person will confirm we received your report, then follow up to tell you whether we could reproduce the problem and what we decided to do about it. We have not committed to a published response time, and we would rather say that than name a number we cannot promise to hold — so if you think a problem is being actively exploited, say so in the subject line.
What we ask of you in return:
•
Give us a reasonable chance to fix the problem before you describe it publicly.
•
Stop as soon as you have confirmed a problem exists. One record or one account is enough to demonstrate it — do not collect, change, or keep data that is not yours.
•
Test with your own account, never someone else’s.
•
Do nothing that degrades the service for members: no denial-of-service testing, no high-volume automated scanning, and no attempts to talk a member or a staff member into handing over access.
SchoolBoardHQ does not run a paid bug bounty program and does not pay for security reports. We would rather be plain about that before you spend time on one than leave you to assume otherwise. If you would like credit for a report we act on, say so and we will credit you by name; if you would rather not be named, we will not name you.
Changes
If we make a material change to our security practices, we update the date at the top of this page.