Security & trust

Sensitive fields — including medical and emergency-contact details, multi-factor authentication secrets, and payment gateway credentials — are encrypted at rest at the database level, with separate encryption keys per data category.

Production traffic is served over HTTPS only, with HTTP Strict Transport Security (HSTS) enforced and secure, HTTP-only session cookies.

Access inside a school is role-based. Parents, teachers, and school admins each see only what their role allows, and school admins can grant staff granular permissions per workflow — such as payments, student records, or staff management — instead of all-or-nothing access.

Logins are protected by signed, short-lived authentication tokens (JWT), with support for asymmetric (RS256) key signing, and optional multi-factor authentication (TOTP) for admin and owner accounts, plus step-up verification before especially sensitive actions.

Administrative actions — student record changes, staff and permission changes, payment actions, and account access events — are recorded in a tamper-evident audit log, so schools can review who did what and when.

The production database is backed up nightly, with each backup verified automatically and support for offsite, encrypted storage. Restore procedures are documented and tested on a regular schedule.

We publish live operational status, including recent uptime and any active incidents, on our status page.

Little's Orbitis an early-stage platform. We do not currently hold SOC 2, ISO 27001, HIPAA, or any other third-party security certification, and we won't claim one until it has actually been independently audited. We're building our controls with recognized frameworks in mind as we grow.

For schools evaluating us during procurement, we publish a draft Data Processing Agreement template covering roles, data categories, subprocessors, and security commitments. It is pending legal review and not yet a signed agreement.

We support responsible disclosure. Security researchers can find our contact details in /.well-known/security.txt (RFC 9116).

For questions about our security practices, or to report a concern, reach us through the contact page.