Built to be trusted with a school.

SOC2 programme

Type 1 first, with Casa Education as the auditee. Stated plainly as in progress — never implied as achieved.

Children's data

Children never use CasaEd directly. The strongest true claims, stated precisely — sourced from our children's-data standard, not marketing copy:

• Designed to support your school's COPPA and state childcare-privacy obligations.
• No child-directed surfaces.
• Children never use CasaEd directly.
• No advertising or sale of data.
• Every access audited.
• Data entered only by parents and schools.

Every action audited

Nothing moves without leaving a record — the same audited gateway behind every product, for every read and every write.

Humans stay in the loop

Every consequential agent action defaults to a human approval gate. Two domains never get an exception:

1. Money

   A charge, a refund, a billing change — proposed, never executed, until a person approves it.

2. Health

   A medication record, an exemption, an intervention plan — proposed, never executed, until a person approves it.

Money and health never auto-execute.

Tenant isolation

Every school's data is scoped to that school on every read and every write, enforced before a query ever reaches the database.

Brand sovereignty

A tenant's brand fully overrides the CasaEd default on every family-facing surface. CasaEd is the platform brand — never forced onto a school's families.

Subprocessors

The current subprocessor list, kept honest as it changes.

• Google Cloud PlatformHosting, storage, and the database
• Vertex AIThe concierges' language model, inside Google's network
• StripePayments
• ResendTransactional email
• KnockMulti-channel notifications
• TwilioSMS