Security & Data Protection

Built for Canadian Schools

Milestone Teachers is designed with Canadian privacy legislation in mind. Schools and teachers should still confirm local notice, consent, procurement, and board requirements before student use.

Security Measures

Encryption in Transit & at Rest

Data is protected with managed cloud transport and storage safeguards. We review infrastructure settings as the platform moves through school privacy assessments.

Secure Authentication

Teacher accounts use secure sign-in. Student access is controlled through class codes with optional PINs for additional security.

Minimal Data Collection

Core classroom workflows do not require student emails. Teachers can use initials, private aliases, and class-level notes so student data stays minimized.

Role-Based Access Control

Teachers only see data from their own classes. Data is scoped by classroom to prevent unauthorized access across accounts.

Audit Logging

Key actions like logins, data access, and changes are logged with timestamps for accountability and compliance.

Compliance & Standards

Our platform is designed to support review against the following Canadian privacy standards:

• PIPEDA-aware data minimization, consent, access, and safeguards review
• MFIPPA-aware school-board review for Ontario classroom use
• Canadian Privacy Commissioner guidance for educational technology and vendor review
• Data minimization principles for K-8 student protection

Infrastructure

Cloud Infrastructure

Our application runs on managed cloud infrastructure with servers in North America (Canada and United States). Database services are provided by Neon PostgreSQL with managed security and storage safeguards.

Data Residency

Data may be processed in Canada, the United States, or other regions used by approved hosting, database, analytics, and AI service providers. School and board deployments can request a vendor and data-residency review before rollout.

Data Retention & Deletion

Right to Deletion

Account, class, roster, export, and broader deletion requests are available through the applicable product or support workflow. Deletion removes data from active product storage and may be subject to backup, security, billing, contract, or legal retention limits.

Consent Tracking

The date and time when each classroom account was created is recorded to support audit trails, school review, and privacy requests. This timestamp can be provided upon request.

Questions About Security?

If you have questions about our security practices or need documentation for your school board's privacy assessment, please contact us: