Data Security
Last updated November 12, 2026
1. IntroductionA. Purpose
- We are committed to protecting the privacy, safety, and integrity of sensitive customer data used for the operation of the Pickcode platform, and this document outlines our policies and plans for meeting these commitments.
- This plan outlines the secure use of computer equipment and systems at Pickcode to mitigate risk of security incidents, data exfiltration, or other breaches.
- The commitments in this plan support our compliance with both federal and local laws and regulations related to the handling of sensitive customer data and Personally Identifiable Information (PII).
- This plan applies to all Pickcode employees and contractors, and all systems used in the operation of the Pickcode platform.
- Review of this document is a part of required training for all Pickcode employees and contractors.
2. Compliance with Legal and Regulatory Requirements
- We commit to adhering to applicable laws and regulations with respect to our handling of student and teacher PII, particularly FERPA, COPPA, New York State Ed Law-2D, the California Consumer Privacy Act, and the California Privacy Rights Act.
- In short, we collect and use the minimum amount of PII to administer Pickcode’s educational platform. We keep such data confidential using the policies and plans outlined in the remainder of this document.
- Our security practices and incident response process are aligned with the NIST Cybersecurity Framework (CSF) 2.0.
3. Administrative SafeguardsA. Data Governance Policies
- Data we store can be categorized as follows:
- Personally Identifiable Information (PII). On Pickcode, users' first and last names and email addresses are the only PII we collect.
- User generated content. Code and other files that users write or upload into the Pickcode platform.
- Public information. Aggregate, anonymized statistics about platform usage.
- Both PII and User Generated Content are safeguarded according to Section 4.
- PII and User Generated Content are securely stored on third party cloud services (Amazon Web Services, Okta Auth0), subject to controls outlined in Section 4.
- Besides the cloud providers listed above, PII and User Generated Content are never shared with outside third parties for any purpose, including but not limited to marketing, advertising, or sales.
- All customer data is stored in the United States.
- When employees start with Pickcode, they review this document and receive training on the technical data safeguards outlined in Section 4.
- This plan is reviewed with all employees on an annual basis.
4. Access Controls and Technical SafeguardsA. Access Controls and Authentication
- All internal tools that Pickcode employees log into require MFA, either directly or via SSO through an MFA-enabled provider, such as Google or Github.
- Customer data is only stored in Amazon AWS and Okta Auth0, and is only ever accessed by Pickcode administrators who must be full time employees.
- Pickcode employees must use randomized passwords stored within personal password managers.
- Laptops of Pickcode platform administrators that have access to sensitive Information must utilize full disk encryption and automatic screen locks after a period of inactivity.
- Access to sensitive information is revoked when an employee or contractor leaves.
- Customer data stored in Amazon AWS is encrypted at rest using the AES-256 algorithm. Okta Auth0 uses industry standard encryption practices for encryption of data at rest.
- All data transferred over the internet is transferred in an encrypted manner via HTTPS (encryption in transit)
- All customer data in Amazon AWS is protected both via database encryption as well as firewall access rules in our Virtual Private Cloud (VPC) provided by AWS. Pickcode administrators access the database via a proxy server and authenticate with this proxy server via 2048 bit RSA SSH keypairs.
- Pickcode's systems are configured wherever possible to receive automatic security patches and updates.
- Pickcode receives notifications of security patches and updates to dependencies that cannot be automatically updated, such as code dependencies, so that they can be reviewed and incorporated promptly.
- Our Amazon AWS database is backed up daily. Database backups are retained for 30 days.
- Restoration of Pickcode's database from a backup is tested at least annually.
- All code changes made by the engineering team are reviewed by at least one other engineer, with a focus on ensuring that new code changes do not introduce security vulnerabilities. During testing of new platform features, internal penetration testing is performed when the new feature may increase the platform’s data security risks.
5. Third-Party ManagementA. Use of Vendors
- Besides the cloud providers mentioned in Section 4, Pickcode does not currently utilize subcontractors.
- Prior to purchasing software from vendors that may interact with customer data, we review available industry data on their security policies, data breach history, and review their security policies and plans. Pickcode only uses vendors whose security safeguards are equivalent or stronger than our own.
- When Pickcode utilizes contractors for the purposes of software development, they are not granted administrator access to systems where customer data is available (AWS or Okta Auth0). If such contractors need customer information for the purpose of customer support or platform maintenance, such information must be provided to the contractor by an administrator user.
- Contractors are subject to mandatory training on the policies outlined in this document prior to beginning work that utilizes Pickcode systems.
6. Incident Management PlanA. Identification of Incidents
- A Security Incident is any "occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies." [NIST definition]
- Pickcode employees regularly monitor platform performance, error logs, performance charts, and other metrics as a first line of defense for identifying incidents.
- Annual penetration tests by outside contractors will also be completed to identify platform vulnerabilities prior to them causing a security incident.
- Any Pickcode employee or contractor is required to report any security incident or suspected security incident upon discovery.
- Any other person who suspects a security incident should contact Pickcode by emailing support@pickcode.io.
- Once the Pickcode team receives a report of an incident or discovers an incident, the person who receives the report or discovers the incident must create a security incident ticket documenting the report, impacted systems, and an initial priority rating from the list below, based on their best judgement of the incident severity.
- Pickcode uses the following priority ratings for incidents. When uncertain which rating to use, bias towards the higher priority (lower number).
- P0: An active threat or attack that could result in breach or nonrecoverable corruption or loss of customer data; or evidence of past attack that may have caused exfiltration, corruption or loss of customer data. Immediate response required.
- P1: An active attack that is causing degradation or disruption of services or recoverable corruption or loss of customer data; or a vulnerability discovered which, if exploited, could result in P0 incident, but no evidence of an active threat or successful exploit.
- P2: A vulnerability discovered which, if exploited, could result in a P1 incident, but no evidence of an active threat or successful exploit.
- P3: A vulnerability discovered which, if exploited, could result in breach or corruption of non-customer Pickcode data (e.g. Pickcode internal data).
- For issues deemed to be P0 or P1, issue containment should take immediate precedence.
- Once an incident has been reported, containment is the engineering team's top priority, e.g. revoking compromised credentials or deploying security patches.
- Pickcode will notify affected customers of the security incident by email within 72 hours of incident discovery. Notification will include Pickcode's understanding of what happened, what data was involved, and how Pickcode is responding.
- Pickcode will cooperate with law enforcement and with any affected school districts. At the request of and with the assistance of school districts, Pickcode may notify affected students or their guardians of the incident.
- Some customer communications may occur during the response, for example alerting users to performance degredation or downtime in the event of an outage. However, some communications cannot be made until the full impact is known. Upon completion of Pickcode's postmortem, affected customers will receive a summary of the incident's cause, impact, and remediation.
- The incident postmortem is a document produced after an incident that documents the incident and its response. It explains how the incident happened and attempts to identify root causes and concrete changes that would prevent similar incidents from happening again. The Postmortem is written for an internal audience and made available to Pickcode employees for future improvement and learning.
- A postmortem includes:
- Non-technical description of the incident (3-4 sentences)
- Impact of the incident to customers
- If incident resulted in outage, how long this lasted
- Systems impacted
- Who reported originally
- Complete incident timeline which should include as much detail as possible, including evidence uncovered from logs, screenshots, code updates, etc.
- A "Five Whys" analysis for identifying the root causes of the indicent.
- A list of action items to address the root causes and prevent similar issues from occurring in the future.
7. Data Return and DestructionA. Data Return Procedures
- Upon customer request at the end of a contract, all customer data can be exported from Pickcode’s systems and returned to the customer. We commit to completing such requests within 5 business days. Upon return, the customer can also request that data be deleted per the policies outlined in Section 7.B.
- Upon customer request, all customer data can be deleted from Pickcode’s systems. We commit to completing such requests within 5 business days. Upon deletion, data will remain in database backups for 30 days (per the retention policy described in Section 4.E). Following that 30 day period, data will be fully absent from our systems.
- In the event that a customer’s relationship is to be transferred to a successor of Pickcode Technologies, LLC (e.g. acquirer), customers will be notified and have the opportunity to request data return or deletion.
- After the data deletion has been completed per the timeline specified in Section 7.B, Pickcode will provide a written document signed by our team ensuring that the data has been removed.
8. Plan Maintenance and ReviewA. Policy Updates
- Pickcode will annually review updates to laws related to data privacy in jurisdictions in which we provide our services, and update this document to stay in accordance with regulations.
- Pickcode performs an annual security risk assessment. The outcome of that assessment will inform changes to this document.
- All Pickcode full time employees and contractors will review this document annually, after the annual security assessment and third party penetration test to ensure relevance and effectiveness. In the event that new members join the team or internal departments are formed, this document will be updated with new procedures and reviewed with those new members.
9. Contact UsIf you have any questions or comments on this plan, or to report a potential security issue, contact support@pickcode.io.
© 2026 Pickcode Technologies, LLC