Security at RoundUp

RoundUp runs child care centers’ attendance, billing, messaging and enrollment, so it holds information about young children and their families. This page explains how we protect it, what we don’t do yet, and how to reach us about a security concern.

1. At a glance

• Hosted on Amazon Web Services in the us-west-2 (Oregon) region
• Encrypted in transit (TLS 1.2 or higher) and at rest (AES-256)
• Production access limited to a small set of engineers using hardware-based multi-factor authentication
• No card or bank numbers stored — payments are tokenized through Stripe
• Integrations send the minimum they need, and never a child’s information unless the integration exists for it
• We don’t hold a SOC 2 report yet. Readiness work is in progress

2. Hosting and availability

RoundUp runs on AWS managed services — Lambda, DynamoDB and S3 — that replicate data across multiple availability zones in us-west-2. CloudFront serves the web portals. Multi-region failover is planned but not yet in place.

Our uptime target is 99.9% on every plan. Multi-Site plans carry a written SLA with credit terms; single-site plans are best-effort (see our terms).

3. Protecting data

• In transit: every connection to RoundUp uses TLS 1.2 or higher
• At rest: databases, file storage and backups are encrypted with AES-256
• Secrets: API keys and integration credentials live in AWS Secrets Manager, never in code or configuration files. Integration tokens stay on our servers and never reach a browser
• Payments: card and bank details go straight to Stripe. We never see or store card numbers, bank account numbers or CVC values
• On devices: the RoundUp apps keep sign-in tokens in the phone’s secure storage (Keychain on iOS, Keystore-backed storage on Android)

4. Access control

For centers

• Accounts are created by invitation from a center. There is no public sign-up
• Roles decide what each person sees: directors, teachers and families each see only their own center, classroom or family
• Strong passwords are required. Single sign-on (SAML/OIDC, including Okta, Microsoft Entra, Google Workspace and Auth0) is available on Enterprise plans

Inside RoundUp

• Production access is limited to a small set of authorized engineers, each authenticated with hardware-based MFA, and every access is logged
• AWS access uses roles with the narrowest permissions we can write. We avoid long-lived access keys on production paths

5. Children’s data

Each center owns and controls the records of the children and families it serves. We process them on the center’s behalf, as described in our privacy policy and student data privacy policy.

• We collect only what running the center requires. We don’t sell personal information, and we don’t use child, family or staff data for advertising or to train AI models
• Any path that could expose a child’s name, photo, date of birth or attendance to someone outside their center is treated as critical, whatever its technical severity score
• Parents who want to review, correct or delete their child’s information should start with their center, and we help the center fulfil the request

6. Integrations

Optional integrations stay off until a center turns them on, and each one sends only what it needs. Our privacy policy lists every service provider and what each receives.

Salesforce

• Connects with OAuth 2.0, using PKCE and a signed state on every connection, and only the api and refresh_token scopes
• Tokens are stored encrypted on our servers. We check that every org address is a Salesforce domain before calling it
• The sync is one-way and touches only Lead records. It reads nothing back, sends no information about children, and never overwrites notes typed in Salesforce
• Disconnecting revokes our access at Salesforce and deletes our copy of the token

Setup details: Salesforce setup guide.

7. Monitoring, backups and incidents

• Continuous monitoring with Amazon CloudWatch alarms and AWS GuardDuty, alerting our team
• Daily automated backups, plus point-in-time recovery for core data
• A written incident-response runbook. If an incident affects a center’s information, we notify the center’s director by email without undue delay, and within any timeframe the law requires

8. How we build

• Every change is reviewed before it ships, and automated checks run on every change
• Secret scanning (gitleaks) runs before code leaves a developer’s machine and again in CI
• Dependencies are monitored and updated automatically, and known vulnerabilities are patched promptly
• We run regular vulnerability scanning against our own services

9. Compliance and documents

• Privacy policy, including COPPA and state privacy notices
• Student data privacy policy
• Terms of service
• SOC 2: not yet. Readiness work is in progress, and we’ll say so here when a report is available
• Security questionnaires: available to Enterprise customers under NDA, with an architecture review. Ask at security@roundupece.com

10. Reporting a vulnerability

Email security@roundupece.com. Please don’t report vulnerabilities in public. If your finding exposes a child’s information, put URGENT in the subject line.

• Tell us what you found, where, and how to reproduce it. A screenshot or request capture helps
• We acknowledge reports within 48 hours and send an initial assessment within 5 business days, with updates at least every 7 days until it’s fixed
• Fix targets: critical within 14 days, high within 30, medium within 60
• We credit researchers who want credit. We don’t run a paid bug bounty

Safe harbor

We won’t take legal action against good-faith research that respects people’s privacy, uses only accounts you own or have permission to test, avoids damaging data or degrading the service, and gives us a reasonable chance to fix the issue before you disclose it. Denial-of-service testing, automated scanning and brute-force attempts against production are out of bounds — ask first and we’ll set up a test environment.

Machine-readable contact details: /.well-known/security.txt.