How We Respond to Security Incidents

We maintain a written incident response procedure. This page summarizes what schools and families can expect; the operational detail stays internal, because publishing it would help an attacker.

Detection

Automated monitoring watches for errors, unusual access to student records, and dependency vulnerabilities. Teachers can report a concern at any time to security@ethis.ai.

Assessment

When an incident is detected, we determine within 24 hours whether student information may have been involved, and classify its severity. Anything touching children's data is escalated immediately to our COPPA officer.

Containment

We stop the exposure first — revoking credentials, ending sessions, or taking the affected part of the Service offline — before investigating cause.

Notification

If children's personal information may have been exposed, we notify in this order: affected schools within 48 hours of discovery, by email and phone; parents through their school within 72 hours; regulators, including the FTC, as required by law. Teachers with accounts are notified directly by email. Each notice states what happened, what information was involved, and what we have done.

After

We complete a written incident report within 30 days and share the relevant findings with affected schools.

Questions: security@ethis.ai · privacy@ethis.ai