Security

At a glance

Encrypted records

AES-256 encryption at rest and TLS 1.2 or higher in transit.

Scoped access

Database-enforced permissions follow assignments, roles and authorized team sharing.

School breach notice

Within 24 hours of Evident becoming aware of a personal data breach involving Student Data.

Review evidence

Internal assessment materials are available through the Compliance Center. Evident does not hold its own third-party SOC 2 certification.

Security Controls

Evident combines database access rules, encryption, scoped sessions, audit history and security review. These controls support the school's privacy program; the signed agreement sets the obligations for each school.

Encryption

Student data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher (TLS 1.3 where the client supports it), with HSTS. Student setup does not request Social Security numbers, birth dates or home addresses. Use display names or initials, and keep unnecessary identifying details out of notes and attachments.

Tenant Isolation

Row-Level Security (RLS) is applied on every table that holds student data, so isolation is enforced by the database engine itself. Access follows student assignments, school membership, roles and explicit sharing, including authorized collaboration across classrooms. Confidential support notes have additional restrictions; being an administrator does not grant access to every private note. Families see only content made available through their scoped family link.

Account protection

Authenticator-app multi-factor authentication is available in account settings, with single-use recovery codes. Deployment policies can require it for administrators or all staff. Schools can confirm the applicable policy during their security review.

Browser Extension Sessions

The optional Evident Capture browser extension authenticates through an explicit user-approved authorization flow and receives its own short-lived session, separate from the web session and subject to the same database-enforced isolation. It can be revoked independently, and deactivating an account revokes it automatically. School administrators can disable extension access for their organization entirely.

Audit Logging

Student-record changes and other recorded actions are kept in an insert-only audit history that authorized school administrators can review. IP addresses and browser details are removed from audit entries after 90 days, the entries themselves are deleted after 24 months, and all of them are removed with the account under the disposition timeline described in our Privacy Policy.

Testing

Evident runs a structured, adversarial security test against the full application at least annually, covering tenant isolation, authorization, billing abuse, input validation and unauthenticated endpoints. The most recent test, in June 2026, found no critical or high issues; the findings log, scope and remediation status are available to schools under review. This is an internal test, not an independent third-party penetration test, and we say so plainly; we will commission an independent test when a school's review requires one. Automated checks run before production release, including tests of authorization and data isolation.

Availability

Evident runs on high-availability cloud infrastructure and targets 99.9% availability. Uptime is tracked with automated external monitoring against a public health check. We do not offer a contractual uptime SLA at this time.

FERPA & GDPR Workflows

Evident supports the deletion requests, data access controls, and documentation workflows used in FERPA and GDPR programs, and provides Data Processing Agreements (DPAs) for schools and districts.

Breach Notification

If Evident becomes aware of a personal data breach involving Student Data, we notify your school or district within 24 hours of becoming aware, with a named contact and the information you need for your own regulatory and family notifications. The full notification commitment, including what each notice contains, is described in the Compliance Center.

Infrastructure and sub-processors

Each vendor has a defined function. This list comes from the same regional register as our DPA, which also describes purposes and transfer arrangements.

On our EU service, student data is stored and processed in the European Union (Frankfurt), and family-facing translation runs through Mistral AI in France with student names removed first. AI writing tools are switched off.

Our database provider, Supabase, maintains its own independent third-party security certification as a sub-processor. Evident's own security program is structured to align with the SOC 2 Trust Services Criteria; this is Evident's own assessment, not a third-party SOC 2 certification of Evident. See the Compliance Center for assessment materials.

Optional AI assistance

AI assistance is invoked through specific product features. Student names are masked before translation and writing requests; free text may still contain other identifying details, so educators should review it before requesting assistance. School controls for note polish and progress narratives do not disable translation. Educators must review outputs before sharing them with families or using them in formal documentation. See the AI usage statement for the feature scope.

School Review Documentation

Reviewing Evident for a pilot or license? Start with the procurement packet, then use the Compliance Center and DPA for deeper privacy and IT review.

The Compliance Center is where you can request the security assessment, incident response summary, and other review documents.

• Procurement Packet
• Compliance Center
• Get DPA
• Data Privacy and Security Plan (NY Education Law §2-d)

Vulnerability Disclosure

We welcome reports from security researchers and from the IT staff of the schools that use Evident, and we commit to working with you in good faith. Our machine-readable contact is published at /.well-known/security.txt.

Scope

evidentk12.com, eu.evidentk12.com, demo.evidentk12.com, the Evident Capture browser extension, the Evident iOS app, and the API they use. Sub-processors (our hosting, database, email and AI providers) run their own programs; please report issues in their platforms to them.

Rules of engagement

• Test with your own accounts. The demo site and a free account are there for this. Never read, change or export a real student's record; if you reach data that is not yours, stop, note what you saw, and report it.
• Stop at proof. One record, one request or one screenshot is enough to show an issue; do not collect more.
• No denial of service, no social engineering of our users or staff, no physical attacks, and no automated scanning at a rate that degrades the service.
• Give us a reasonable time to fix before any public disclosure. We ask for 90 days from your report, and we will tell you sooner if a fix ships earlier.

What we commit to

• Acknowledge your report within two business days at security@evidentk12.com.
• Tell you within ten business days whether we could reproduce it and how we rated its severity, and keep you informed until it is resolved.
• Fix critical and high issues ahead of all other work, with a target of seven days; medium within 30 days; low within 90 days.
• Credit you by name on request. We do not run a paid bounty program today.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not pursue or support legal action against you for it, we will not refer it for prosecution, and if a third party brings a claim about research conducted under this policy we will make it known that you acted with our authorization. This authorization does not extend to anyone who violates the rules above, accesses or retains student data beyond what is needed to demonstrate an issue, or acts against a school's own systems.

Contact the Security Team

For security questions, to report a vulnerability, or to request a security review, reach out to our security team.