Written for the IT lead or security officer evaluating Rekods. Where a control is fully in place, we say so. Where something's in progress, we say that too, with a timeline. We'd rather give you an accurate picture you can verify than a polished one that doesn't hold up.
A cloud platform on managed infrastructure. Backend and database on Xano; authentication via Stytch B2B (JWT); file storage encrypted at rest; a dedicated append-only audit pipeline; AI via Anthropic's API, server-side, never used for training. The guiding principle: collect the minimum, separate every school, control by role, encrypt everything, log every access.
TLS in transit, industry-standard encryption at rest, and secrets held in server-side environment variables never exposed to clients.
Two-gate authorization on every sensitive request. Gate 1 checks role access to the data domain (academic, attendance, financial, operational). Gate 2 checks entity scope (organization, school, or only the classes a teacher teaches). Enforced by one reusable function so there's no drift. Least privilege throughout.
Every record carries organization and school identifiers, and every query is scoped to the authenticated user's context from their token, not client input. One school can never reach another's data. Enforced at the data layer.
Every access and mutation of sensitive student data is recorded (who, what, on what, when) via a non-blocking queue to durable append-only storage. Tiered retention aligned to FERPA.
We collect only what's needed to run the features a school uses. Data not collected can't be exposed.
AI operates on a school's own data to serve that school. It is never used to train external models, never pooled across schools, and calls are made server-side and not retained by the provider for training.
Xano (backend/DB), Stytch (auth), AWS (storage), Anthropic (AI), SendGrid (email), and Firebase Cloud Messaging (push). Compliance documentation available on request.
FERPA, COPPA (under-13 routing to guardians), and GDPR (which applies to any school with EU-resident students or parents, regardless of location). Designed in from day one. We will sign a DPA.
We notify the affected school promptly with specifics, support their own notification obligations, and never go quiet or downplay.
The school owns all its data. Rekods is custodian, not owner. Full export any time, no lock-in.
SOC 2 status
We're building toward SOC 2 Type II and implementing the underlying controls the audit assesses. We are not currently certified, and we won't claim to be until we've completed the audit. We can share our current posture in detail, our committed timeline, our data privacy agreement, and subprocessor compliance documentation. For schools able to evaluate posture directly, we welcome the deepest technical scrutiny. Bring your hardest questions.
Want to go deeper? We'll hold a technical session with your IT and security team, walk through the architecture, complete your vendor security questionnaire, and review your data privacy agreement.