Security and privacy FAQ
Where is our data stored?
Canadian centres are hosted in Canada and US centres in the US, including backups and AI processing. The region is shown on your account and stated in your contract.
Who can see a child’s information?
Only staff at that child’s centre whose role needs it, and the child’s own guardians, within any custody rules the centre has set. Permissions are checked on our servers and again in the database.
How are photos protected?
Photos are stored privately and open only through links that expire within 15 minutes. Location data is removed when a photo is uploaded. Each family’s photo consent is honoured.
How do staff sign in?
Owners, directors and bookkeepers must use two-step sign-in or a passkey. Shared classroom tablets use a personal PIN on a registered device and lock after 2 minutes idle. Multi-site operators can use single sign-on.
Is data encrypted?
Yes, in transit and at rest. Medical notes, custody notes and government ID numbers have extra field-level encryption.
Can we see who accessed our data?
Yes. The audit log shows sign-ins, exports, permission changes and views of sensitive records, kept for 2 years. You get an alert on any bulk export.
Do you use trackers or sell data?
No. Kinfold’s apps contain no advertising or third-party analytics code, and we never sell data. We publish every third party that processes your data, what it does and where. [Third-party list to be published before launch.]
Do you train AI on our data?
No. Children’s data is never used to train AI models, and our AI providers are contractually barred from keeping it.
What happens to data when a child leaves?
Records are kept for the period your licensing rules require, then deleted automatically. Families can download their child’s photos for at least 2 years after leaving. Owners can export all data at any time, free.
Privacy impact assessments
We provide templates for Quebec’s Law 25 and for public operators who need a privacy impact assessment. [Templates available on request during the pilot.]
What if something goes wrong?
We notify affected centres within 72 hours of confirming a breach and notify regulators as the law requires. We practise our response twice a year.
Certifications
SOC 2 Type I audit targeted for Q3 2027. External penetration test before launch.
Reporting a vulnerability
Email [security@YOUR-DOMAIN]. We acknowledge reports within 2 business days and won’t take legal action against good-faith research that follows our disclosure policy.