Chalk

Built for district IT

Security at Chalk

Chalk handles credentials, identity, and rosters for entire districts. Security is not a feature bolted on at the end — it shapes how the platform is designed, hosted, and operated.

Encryption

Sensitive material is encrypted at rest and in transit.

  • AES-256-GCM at rest for credentials, OAuth tokens, SAML keypairs, and OIDC JWKs.
  • TLS 1.2+ for all data in transit, with HSTS enabled on the hosted service (preload submission in progress).
  • Master-key rotation supported without service downtime.

Tenant isolation

Each district runs in its own logical environment.

  • Per-tenant Postgres schema with row-level enforcement on shared metadata.
  • Per-tenant scheduler with noisy-neighbor protection on sync jobs.
  • Tenant identifiers carried through every audit-log entry.

Identity

Chalk can be your district's identity provider.

  • Self-hosted SAML 2.0 IDP with auto-generated keypairs and metadata endpoint.
  • OIDC federation for downstream applications.
  • Argon2id password hashing with per-tenant tunable cost.
  • Configurable session timeout, absolute lifetime, and idle expiry.

Audit logging

Security-relevant events are recorded and searchable.

  • Successful and failed login attempts, including source IP and user agent.
  • Password changes, badge generation and revocation, and admin actions.
  • Tenant provisioning, role changes, and master-key rotations.
  • Searchable by user, IP, event type, and time range.

Web security

Defense in depth at the application layer.

  • CSRF tokens on every state-changing request.
  • Strict Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers.
  • Subresource Integrity on CDN-loaded scripts.
  • HSTS with preload, plus secure and HttpOnly cookies.

Data handling

Our commitments on what we will never do with student data.

  • We never sell student data.
  • We never use student data for advertising or profiling.
  • We never train AI models on student data.

Compliance posture

Where we are and what is on the roadmap.

  • FERPA: Chalk operates as a school official with a legitimate educational interest.
  • COPPA-aware: districts retain school authorization for under-13 processing.
  • SOC 2 Type II: on the roadmap, not yet obtained.
  • State student-privacy laws: DPA template aligned with common requirements.

Reporting vulnerabilities

We welcome reports from security researchers and district IT teams. Email security@usechalk.xyz with reproduction steps and your preferred contact details. We follow a coordinated responsible-disclosure policy: we will acknowledge reports within two business days, work with you on a fix, and credit reporters who wish to be named once the issue is resolved.

Please do not access data beyond what is necessary to demonstrate the issue, and do not run denial-of-service tests against the hosted Service.