Happy Numbers Inc. maintains administrative, technical, and physical safeguards that equal industry best practices, including, but not necessarily limited to, disk encryption, file encryption, firewalls, and password protection. We use encryption technology to protect data in motion and at rest from unauthorized disclosure.
Administrative and Operational Safeguards we use to protect your Personal Information:
Minimizing the Use, Collection, and Retention of Personal Information: We store the minimum information required for the proper functioning of our services. We collect minimum information from Single Sign-On (SSO) systems such as ClassLink and Clever.
Anonymizing Information: We use a unique tool to prepare databases for test and development environments with complete anonymization of Personal Information. Developers and QA engineers cannot access real personal data throughout the development lifecycle.
Access Enforcement: All employees have personal auditable accounts in all our systems. We use Single Sign-On to grant access to all internal systems. Critical applications, such as the admin panel, have role-based access control for different access levels.
Separation of Duties: We adhere to the principle of minimizing access, which means that, for instance, a content manager can access the BI system with de-identified student problem-solving logs, but they do not have access to the admin panel with Personal Information.
Least Privilege: Our internal systems use a role-based access control model to grant each employee the minimum required access level.
Remote Access: All communication with our servers and systems is encrypted using battle-tested protocols, such as enforced HTTPS with TLS 1.2, SSH, and OpenVPN.
Auditable Events: We collect all change events in our SSO system and admin panel and store them in a database without making any modifications.
Protection of Information at Rest: We store our backups in AWS S3 using the pgBackRest tool with AES-256-CBC encryption. Furthermore, our application servers transparently encrypt Personal Information using a symmetric cipher before storing it in an encrypted database
Data Backup and Recovery: We continuously back up all production PostgreSQL databases using the pgBackRest tool and retain data for 30 days, including four weekly full backups.
Change Management: Our infrastructure is entirely managed by Infrastructure as Code (IaaC) tools, including a custom in-house CLI tool, Terraform, and Ansible. This means that all the changes can be reviewed through standard development procedures and stored in GitHub.
Password Guidelines
We strive to ensure that your experience with Happy Numbers is one of utmost security and confidence. Your Personal Information is kept safe with a strong password. To ensure no one unauthorized gets into your account or accesses your Personal Information, you should choose a strong password, be careful about who has access to your computer and browser, and always remember to sign off when you are done using your account.
What we will do in case of a data breach
In the event that we become aware of an unauthorized disclosure or data breach:
The district, school officials, and teachers will be notified within 24 hours by email if the teacher account or any related student accounts are affected. The appropriate person in the school or school district who has purchased the valid school-wide or district-wide Happy Numbers access will be notified by phone. The notification will include the date of the breach, the types of information that were subject to the breach, a general description of what occurred, and steps we are taking to address the breach.