Classe365 
Hiree365 
Enterprise Trust
Security and compliance your review board expects
Meet institutional security requirements with trusted frameworks, rigorous controls, and compliance-ready practices. Everything on this page is set out in full in our Security Statement.
-
SOC2
Compliant
-
COPPA
Compliant
-
GDPR
Compliant
-
FERPA
Compliant
-
ISM Australia
Compliant
-
AWS
Hosting, with network segregation and DDoS protection
-
TLS + at rest
Encryption, including backups
-
24 hours
Breach notification to affected customers
-
30 days
Monitoring and admin-action log retention
-
2 business days
To acknowledge a vulnerability report
Data protection
How we protect your institution’s data: the controls behind the badges, in plain language. Each one points to the section of the Security Statement that commits us to it.
-
Encrypted in transit and at rest
TLS on every connection and HTTPS only. Data is encrypted at rest, including backups.
Security Statement §4
-
No card data stored
Online fee payments are processed by Stripe and PayPal. Classe365 does not store card details.
Security Statement §4
-
Roles you control
Least-privilege access inside Classe365. Your administrators set roles and permissions for staff, students, parents and agents.
Security Statement §5
-
Tenant separation
Each institution’s data is held in its own tenant, and access is scoped to that tenant. Staff administrative actions are logged.
Security Statement §5
-
Multi-factor authentication
Add a second sign-in step for staff accounts.
Help docs article 17172592
-
24-hour breach notification
If a personal data breach affects your data, we notify you within 24 hours of becoming aware of it, with what we know at the time.
Security Statement §10
Infrastructure
Every plan runs on the same secured platform. Enterprise institutions can choose where it runs.
-
Hosted on Amazon Web Services
Classe365 runs on AWS infrastructure, with network segregation and DDoS protection in front of the platform.
Security Statement §3.1, 3.3, 3.4
-
Your allocated region
Standard customers are hosted in the AWS region allocated at set-up, generally the region nearest to them. Ask us about the nearest available region.
Security Statement §3.2
-
Daily backups
Data is backed up daily, and backups are encrypted at rest.
Security Statement §6
-
Monitoring
Availability, performance and security events are monitored, with logs kept for 30 days.
Security Statement §8
-
Secure development
An OWASP-aligned development lifecycle, with every change reviewed before release.
Security Statement §7
Classe365 cloud on AWS
Hosted in the AWS region allocated to your account at set-up, generally the region nearest to you. The nearest available region can be arranged on request.
- Encrypted in transit and at rest
- Tenant separation and role-based access
- Monitoring and daily backups
Security Statement §3.2
Private cloud on AWS, Microsoft Azure or Google Cloud
Run Classe365 in a dedicated private cloud on the provider your IT team already governs.
- Choose AWS, Microsoft Azure or Google Cloud
- Enterprise availability target of 99.5% monthly uptime
- 24/7 support from Australia, India, the Philippines, Spain and the United States
Security Statement §3.2, §12, §13.3
Privacy
FERPA, GDPR and COPPA commitments, and a written program for children’s data.
-
Children’s data program
A written children’s information security program. No targeted advertising to children, and no advertising profiles.
Security Statement §9
- Personal Data Processing Agreement Our DPA, with the EU SCCs Module Two for transfers. www.classe365.com/classe365-personal-data-processing-agreement-dpa
- FERPA compliance How Classe365 supports schools under FERPA. www.classe365.com/classe365-compliance-with-ferpa
- Privacy Policy What we collect, why, and your rights, including GDPR. www.classe365.com/classe365-privacy-policy
- Children’s Privacy Policy How we handle information about children (COPPA). www.classe365.com/classe365-childrens-privacy-policy
AI and your data
AI and your data
Your data is never used to train shared AI models
Customer, student and candidate data is not used to train, fine-tune or improve any general-purpose or shared AI model. Where a feature learns from data, it learns only from your institution’s own data, for your institution.
AI use and transparency- AI analytics stays in our hosting. Grading, attendance, attrition and behaviour analysis use small language models hosted in our own AWS environment.
- Agent automation is an add-on. It uses models from OpenAI, Anthropic and Google through their business API services, under terms that do not permit training on your data.
- Children’s data is protected. It is never used to train, fine-tune or improve a general-purpose model.
Security Statement §5, §7, §9
Policies
Everything is public. For a security questionnaire, the DPA countersigned, or the SOC 2 report under NDA once available, email clientservice@classe365.com.
- Security Statement Hosting, encryption, access, incident response and audits, in full. www.classe365.com/security-statement
- Personal Data Processing Agreement Our DPA, with the EU SCCs Module Two for transfers. www.classe365.com/classe365-personal-data-processing-agreement-dpa
- FERPA compliance How Classe365 supports schools under FERPA. www.classe365.com/classe365-compliance-with-ferpa
- Privacy Policy What we collect, why, and your rights, including GDPR. www.classe365.com/classe365-privacy-policy
- Children’s Privacy Policy How we handle information about children (COPPA). www.classe365.com/classe365-childrens-privacy-policy
- Direct notice to parents The notice schools can share with parents. www.classe365.com/direct-notice-to-parents
- International data transfers Where data may travel and the safeguards we use. www.classe365.com/classe365-international-data-transfers
- Sub-processors The short list of providers that handle customer data. www.classe365.com/sub-processors
- Data retention schedule How long each type of data is kept. www.classe365.com/data-retention-schedule
- AI use and transparency Which AI features use which models. www.classe365.com/ai-use-and-transparency
- US state privacy notice Notice for residents of US states with privacy laws. www.classe365.com/us-state-privacy-notice
- Accessibility statement Our accessibility commitments. www.classe365.com/accessibility-statement-for-classe365
Responsible disclosure
Found a vulnerability? Tell us. Reports go to clientservice@classe365.com, under our Vulnerability Disclosure Policy.
Responsible disclosure
Found a vulnerability? Tell us.
We welcome reports from security researchers. Good-faith research within the scope of our policy is covered by safe harbour. We do not run a paid bounty programme.
- 2business days AcknowledgementWe confirm we have your report.
- 5business days Initial assessmentWe tell you whether it is in scope and how serious we think it is.
- 14days Regular updatesWe keep you posted at least every 14 days until it is fixed.
Bring us your security review
Send your security questionnaire or DPA request to our client service team, or see the controls in a demo.