Trust
Vendor risk answers
Draft — not yet in effect
Draft — under review. This page describes how KiteQuad is built today and is being reviewed by counsel. It isn't a binding policy yet, and the wording may change before launch.
Districts often ask a vendor to complete the CoSN/SETDA K-12 Community Vendor Assessment Toolkit (K-12CVAT). Below are KiteQuad's answers, grouped by the toolkit's topic areas, each with a source you can check. This page is our own plain-English statement — it doesn't reproduce the toolkit's questions — so a reviewer can read our position before we fill in your copy of the official workbook.
Download as a spreadsheet (CSV)
Opens in Excel, Google Sheets or Numbers.
Company
| Topic | Answer | Source |
|---|---|---|
| Product and purpose | KiteQuad is a hosting and runtime layer that lets K–12 teachers publish web apps they build with AI tools to their students safely, with one data agreement covering every app a teacher makes. | PRD §1 |
| Business model | Revenue comes from teacher and school subscriptions, never from data. Every feature is free during the beta; paid Teacher Pro, School and District plans follow. | PRD §9 |
| Who operates the service | KiteQuad is run by its founder, an active K–12 teacher, as an automated, well-tested service with no manual app-review loop. | CLAUDE.md |
Data privacy
| Topic | Answer | Source |
|---|---|---|
| Student personal information collected | In anonymous mode — the default for every teacher — none: a student is a nickname and an avatar the teacher picks, with no real name and no email. Real names and rostered email are part of authorized mode, which a school turns on under a data agreement. | PRD §6 |
| Consent model | A school or district, not an individual teacher, decides when real student data is collected, following FTC COPPA guidance and FERPA's school-official exception under a written data agreement. | PRD §6, §11 |
| Sale of data and advertising | Student data is never sold, and no advertising is shown anywhere in the service. | PRD §10 |
| Use of data for AI training | Neither KiteQuad nor any subprocessor trains AI on student data. | PRD §10, §11 |
| Data retention | What a student app saves is deleted 30 days after the last change in anonymous mode; in authorized mode it follows the school's retention setting (default end of school year, at most 365 days). | PRD §6, §10; SPEC §13 |
| Student AI opt-out | Student-facing AI is off in the first release. When it is enabled, a parent can opt a student out without penalty, and there are no companion or persona chatbot features. | PRD §11 |
Data security
| Topic | Answer | Source |
|---|---|---|
| Encryption | All traffic uses HTTPS (TLS). Stored data sits in Cloudflare D1 and R2, which encrypt data at rest. | SPEC §16; PRD §10 |
| Authentication and access control | Teacher accounts exist only for a verified email; passwords are stored as salted one-way hashes. Operator (staff) access requires 2-step verification, and least privilege is enforced throughout. | SPEC §6, §16; PRD §10 |
| Audit logging | Every operator view that carries a school's data writes an append-only audit record of who looked and at what. Audit records hold internal ids and action names only. | SPEC §15, §16 |
| What is kept out of logs | Student names, nicknames, saved values, submissions, PINs, tokens and secret-scan matches are never written to logs, emails or error trackers. There is no third-party error-tracking on student-facing pages. | SPEC §15; non-negotiable 4 |
| Information security program | KiteQuad maintains a written information security program and reviews its risks at least annually. | PRD §11 |
Application security
| Topic | Answer | Source |
|---|---|---|
| Tenant isolation | Every data request is scoped to the requester's membership; one teacher's or school's resource answers as not-found to anyone else. Schools are kept apart by host-scoped sign-in cookies. | SPEC §16; non-negotiable 5 |
| App sandboxing | A teacher's published app runs on a separate web domain that holds no sign-in or cookies, under a policy that blocks network access. The one built channel for saving data keeps it inside the platform; other channels an app might use are detected and reported to the teacher. | SPEC §7; non-negotiables 1, 2, 12 |
| Pre-publish content checks | Every app is checked before students see it for secret keys, trackers, inputs that ask for personal information, and links off the platform — the same check whether it is uploaded or published from a linked GitHub repository. | SPEC §9 |
| Third-party code on student pages | No third-party scripts, analytics or fonts run on any page a student sees. | non-negotiable 6 |
| Vulnerability reporting | Security issues can be reported to support@kitequad.com; reports are acknowledged and the reporter is kept posted through the fix. | Security overview (/security) |
Incident response
| Topic | Answer | Source |
|---|---|---|
| Breach notification to schools | Affected schools are notified without undue delay — the target is within 72 hours of confirming an incident, and in every case within the windows the law sets (New York Part 121: 7 days; Illinois SOPPA: 30 days). | PRD §11 |
| Incident runbook | KiteQuad maintains an incident-response runbook with a 72-hour notification target. | PRD §11 |
Compliance
| Topic | Answer | Source |
|---|---|---|
| COPPA | Anonymous mode is designed to collect no personal information from students; collecting real data needs a school's authorization under a data agreement. | PRD §6, §11; COPPA notice (/coppa) |
| FERPA | KiteQuad acts as a school official with a legitimate educational interest under the school's direction, and does not redisclose student data or use it for its own purposes. | PRD §11 |
| State student-privacy laws | Storage location is disclosed, breach notice follows New York Part 121 and Illinois SOPPA timelines, certified deletion follows California AB 1584, and there are no companion/persona chatbots and a student AI opt-out per Oklahoma SB 1734 and California SB 243. | PRD §11 |
| Accessibility | The service targets WCAG 2.1 AA, with automated axe checks on every page in the build and a release held on any serious or critical violation. | PRD §10; Accessibility statement (/accessibility) |
| Certified deletion | On request, or at the end of a contract, student data is deleted and a certificate of what was removed (by id and count) is produced. | PRD §11; SPEC §15 |
Data location
| Topic | Answer | Source |
|---|---|---|
| Hosting location | The database and file storage are created in Cloudflare's United States jurisdiction; requests are served from the Cloudflare location nearest the user. | SPEC §18; PRD §10 |
| Subprocessors and where | Cloudflare (hosting, database, files, adult email; United States) and Stripe (a teacher's own billing only, never student data; United States). | PRD §10, §11; Subprocessors (/subprocessors) |
| Data residency | Nothing personal is kept in a globally replicated store; new databases and buckets are created in the US jurisdiction, which cannot be changed later. | non-negotiable 13; PRD §10 |
Need your own copy filled in?
If your district uses the official K-12CVAT workbook, send it to support@kitequad.com and we'll complete it with these answers. For the data agreement and other documents, see the trust center.