Security Overview

1. Our Commitment

KodomoHub handles children's personal information on behalf of BC families and licensed childcare providers. We take that responsibility seriously. This page describes the security and privacy controls we have in place so providers, families, and licensing bodies can make informed decisions about the platform.

We do not publish implementation-level details here — doing so would reduce rather than increase security. What we publish is the evidence of external certification, the policies we follow, and how to reach us when something needs our attention.

2. Data Residency

Certain operational functions — sending transactional emails, processing payments, rendering maps — require data to be briefly processed by specialist third-party providers outside Canada. In every case, the data involved is limited to the minimum necessary for that specific function, and each provider is bound by a Data Processing Addendum ensuring protection comparable to BC's privacy laws.

The full list of sub-processors and the data each receives is published in our Privacy Policy — Data Residency section.

3. Infrastructure Certifications

KodomoHub is built on infrastructure certified to internationally recognised security standards. The certifications below are held by our infrastructure providers, not KodomoHub as an entity — we will always be clear about that distinction.

Certification status changes over time. For current attestations, consult each provider's trust and compliance pages directly. KodomoHub does not hold independent SOC 2 or ISO 27001 certification at this time.

4. Encryption

• At rest: All data stored in the database and file storage is encrypted at rest using AES-256, managed by the underlying cloud infrastructure.
• In transit: All connections between your browser and KodomoHub are encrypted using TLS 1.2 or higher. Connections between our application servers and supporting services are also encrypted in transit.
• Documents: Uploaded documents (verification files, enrollment forms, registration PDFs) are stored in private, access-controlled storage. They are never reachable via a public URL — access is granted only through signed, time-limited URLs generated on demand for authorised users.
• Payments: No credit card numbers, CVVs, or banking details are ever transmitted to or stored on KodomoHub's servers. Payment card data is handled entirely within Stripe's PCI DSS Level 1 certified infrastructure.

5. Access Controls & Audit Logging

Role-Based Access

All provider accounts use a four-level role model. Each role is defined by a specific set of atomic privileges — no role inherits more than it needs.

Staff with limited roles see masked child information by default — last names and exact dates of birth are visible only to authorised personnel. Staff at one facility cannot access records belonging to another facility, even within the same organisation.

Database-Level Enforcement

Access controls are enforced at the database level — not only at the application layer. Every query is evaluated against the authenticated user's identity before any data is returned. This means a misconfigured application cannot inadvertently expose data that the database rules prohibit.

Audit Logging

Every access to sensitive data by platform administrators and auditors is recorded in an immutable audit log — including which record was accessed, by whom, and when. Audit logs cannot be modified or deleted, even by Super Admins.

Providers can see a log of all administrator accesses to their facility's records on request by contacting privacy@kodomohub.ca.

6. Privacy & Data Protection

• BC PIPA: KodomoHub handles personal information in accordance with British Columbia's Personal Information Protection Act. A designated Privacy Officer oversees compliance at privacy@kodomohub.ca.
• Data minimization: We collect only the minimum personal information necessary for each specific purpose. Children's exact dates of birth, for example, are not collected until an enrollment offer is made and accepted.
• No secondary use: Personal information — especially children's data — is used only for the enrollment transaction it was collected for. It does not flow to analytics pipelines, marketing services, or any third party outside the sub-processors listed in our Privacy Policy.
• Automated retention: Scheduled background processes enforce data retention and anonymization schedules automatically, in line with BC PIPA and Canada Revenue Agency requirements. Data is not held longer than legally required.
• Multi-factor authentication: MFA is available to all users and is strongly recommended for provider accounts. Platform administrator accounts require MFA.

Full details — including retention periods, your rights under PIPA, and how to submit a data access or deletion request — are in our Privacy Policy.

7. Sub-Processors

KodomoHub uses a small number of specialist third-party providers to operate the platform. Each is selected for their security posture and bound by a Data Processing Addendum. We do not use any provider that transfers personal information outside Canada without contractual safeguards comparable to BC's privacy laws.

The complete sub-processor list — including provider names, countries of operation, the data each receives, and the purpose — is published in the Data Sharing & Disclosure and Data Residency sections of our Privacy Policy. We update the Privacy Policy whenever a sub-processor is added, changed, or removed.

8. Responsible Disclosure

If you discover a security vulnerability in KodomoHub, please report it to us before disclosing it publicly. We commit to:

• Acknowledging your report within 2 business days
• Keeping you informed as we investigate and remediate
• Not pursuing legal action against researchers who act in good faith

Please include a clear description of the vulnerability, the steps needed to reproduce it, and — if possible — an assessment of potential impact. Do not access, modify, or delete data belonging to other users while investigating.