Security at Chalk

Sensitive material is encrypted at rest and in transit.

• AES-256-GCM at rest for credentials, OAuth tokens, SAML keypairs, and OIDC JWKs.
• TLS 1.2+ for all data in transit. The hosted service sends Strict-Transport-Security with max-age=31536000, includeSubDomains, and the preload directive.
• Master-key rotation supported without service downtime.

Each district runs in its own logical environment.

• Per-tenant Postgres schema with row-level enforcement on shared metadata.
• Per-tenant scheduler with noisy-neighbor protection on sync jobs.
• Tenant identifiers carried through every audit-log entry.

Chalk can be your district's identity provider.

• Self-hosted SAML 2.0 IDP with auto-generated keypairs and metadata endpoint.
• OIDC federation for downstream applications.
• Argon2id password hashing with per-tenant tunable cost.
• Configurable session timeout, absolute lifetime, and idle expiry.

Security-relevant events are recorded and searchable.

• Successful and failed login attempts, including source IP and user agent.
• Password changes, badge generation and revocation, and admin actions.
• Tenant provisioning, role changes, and master-key rotations.
• Searchable by user, IP, event type, and time range.

Defense in depth at the application layer.

• CSRF tokens on every state-changing request.
• Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers.
• Front-end assets are served from Chalk itself rather than a third-party CDN. The one exception is Cloudflare Turnstile, loaded from Cloudflare on the signup page for bot protection; Subresource Integrity does not apply to it, because Cloudflare updates that script and publishes no stable hash to pin.
• Secure and HttpOnly session cookies, plus the HSTS policy described under Encryption. Chalk is not yet on the browser HSTS preload list — the directive is sent, the submission has not been made.

Our commitments on what we will never do with student data.

• We never sell student data.
• We never use student data for advertising or profiling.
• We never train AI models on student data.

What we can state today, and what we cannot.

• We do not publish an uptime SLA. Chalk is pre-GA on the hosted service; committing to a number we have no operating history behind would be dishonest.
• Backups of the hosted database are documented as an operator procedure, with a tested restore path. We do not yet publish a recovery point or recovery time objective.
• Self-hosted operators own their own backup and recovery; the repository ships a pg_dump-based runbook and restore-drill guidance.
• If your procurement requires availability, RPO, RTO, or response-time commitments in writing, ask us during the quote — we will tell you what we can commit to rather than publish a number here we cannot stand behind.

How to reach us and what we commit to.

• Paid hosted tiers include email support during US business hours.
• Security reports are acknowledged within two business days (see below).
• Self-hosted support is community support on GitHub issues.
• There is no published per-severity response-time SLA. Ask at quote time if you need one.

Where we are and what is on the roadmap.

• FERPA: Chalk operates as a school official with a legitimate educational interest.
• COPPA-aware: districts retain school authorization for under-13 processing.
• SOC 2 Type II: on the roadmap, not yet obtained.
• State student-privacy laws: DPA template aligned with common requirements.