1. Purpose
This Data Security Plan is the written information security program for the MyVirtualTAs platform. It defines the administrative, technical, and physical safeguards that Trivium Education Services Pvt. Ltd. uses to protect the confidentiality, integrity, and availability of information processed through MyVirtualTAs.
The plan supports compliance with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA) and its implementing rule and applicable state student data privacy laws.
2. Scope
This plan applies to all information processed by MyVirtualTAs, including student personal information, education records, session recordings, student-generated content, authentication data, and operational data. It covers every person and system that can access that information: employees, tutors, contractors, and subprocessors.
Where a school or district has signed a data privacy agreement with us, that agreement governs the handling of its data. If the agreement sets a stricter requirement than this plan, the stricter requirement applies.
3. Roles and Responsibilities
Security Coordinator
Stefani Resseguie is designated to coordinate this program, run the annual risk assessment, and lead incident response.
Management
Approves this plan and its updates, provides resources, and receives an annual report on the program's effectiveness.
Engineering & Operations
Implement and maintain technical controls, monitor systems, apply patches, and manage backups.
All Personnel
Follow this plan, protect credentials, handle student data only as needed for their role, and report suspected incidents immediately.
4. Risk Assessment
At least once a year, and whenever there is a significant change to the platform, the Security Coordinator conducts a documented risk assessment. It identifies internal and external risks to the confidentiality, integrity, and availability of student information. The assessment considers:
- The sensitivity of the data, with priority on children's data and session recordings.
- Threats to applications, infrastructure, staff devices, and subprocessors.
- The effectiveness of existing safeguards and the results of security testing.
Identified risks are recorded with an owner and a remediation plan, and the results feed directly into updates of this plan.
5. Administrative Safeguards
- Documented security policies and procedures, approved by management.
- Access to student data granted strictly on a need-to-know basis for the purpose of delivering tutoring services.
- All employees, tutors, and contractors sign confidentiality agreements before receiving access.
- Documented onboarding and offboarding procedures.
- Incident reporting and response procedures (Section 11).
6. Technical Safeguards
| Control | Implementation |
|---|---|
| Encryption in transit | All data transmitted over public networks is encrypted using TLS 1.2 or higher. |
| Encryption at rest | All data stored on Microsoft Azure is encrypted at rest using AES-256. |
| Password storage | Passwords are stored as salted hashes using bcrypt and are never stored in plain text. |
| Logging and monitoring | Security-relevant events (sign-ins, administrative actions, access to student data) are logged, monitored, and retained for 90 days. |
| Secrets management | API keys and credentials are stored in Azure Key Vault and are never committed to source code. |
| Domain security | DNSSEC is implemented for the platform's domain infrastructure. |
7. Access Control and Authentication
User sign-in
- Username and password.
- Clever Single Sign-On, where enabled by the school or district.
- ClassLink Single Sign-On, where enabled by the school or district.
Role-based access
Students
See only their own account, sessions, and content.
Tutors
See only the students assigned to their sessions.
School & District Staff
See only students belonging to their own school or district.
Internal Administrators
Production access is limited to staff and requires approval.
Access reviews
Internal access rights are reviewed quarterly. Access is removed within 24 hours of a role change or departure.
8. Physical Safeguards
MyVirtualTAs runs entirely on cloud infrastructure. Our hosting providers' data centers hold SOC 2 Type 2 and ISO 27001 certifications and provide 24/7 monitoring, controlled and biometric entry, and environmental protection.
- No student data is stored on office premises or on removable media.
- Staff devices used to access systems have full-disk encryption, screen lock, and up-to-date security software.
9. Data Use and Protection
We collect only the information needed to provide tutoring services. The school or district owns and controls its student data, and MyVirtualTAs acts as a "school official" under FERPA.
- Student data is used only to provide educational services authorized by the school or district.
- Student data is never sold, rented, or used for advertising or marketing.
- No profiles of students or parents are built for non-educational purposes.
- De-identified data is used only as permitted by the governing agreement. We never attempt to re-identify it, and data sets covering fewer than 20 individuals are not treated as de-identified.
- Live session video and audio, and session recordings, are treated as sensitive data. No facial recognition or other biometric processing is performed.
No advertising use: MyVirtualTAs does not use student information for advertising, marketing, or targeted advertising of any kind.
10. Subprocessors and Data Location
The following subprocessors store or process user data on our behalf. Each provider receives only the minimum data it needs.
| Subprocessor | Purpose | Data Processed | Data Storage Location |
|---|---|---|---|
| Microsoft Azure | Servers, databases, analytics, network infrastructure and email services | All user information and uploaded content, device ID, request data and logs (encrypted at rest) | United States |
| Lessonspace | Virtual classroom: video conferencing, audio, chat and whiteboard | Name, live video and audio, chat messages, whiteboard content, session data | Europe (EU-based AWS servers); provider based in South Africa |
| VDOcipher | Secure, encrypted hosting of recorded sessions | Session recordings | AWS servers; provider based in Bengaluru, India |
| Google Firebase | Backend infrastructure, user authentication and notifications | Name, email address, Google account or Apple ID, IP address | Google Cloud Platform (United States, Europe and Asia) |
| Google reCAPTCHA | Bot protection on sign-in and registration | IP address, browser and device information | United States |
| Clever | Single Sign-On and roster syncing | Student name, school email, grade level, school/district ID, roster data | United States |
| ClassLink | Single Sign-On and roster syncing | Student name, school email, grade level, student/roster IDs | United States |
| Tawk.to | Live support chat | Name, email address, IP address, chat transcripts | Provider based in Las Vegas, Nevada, USA |
| Stripe | Payment processing for MyVirtualTAs purchases | Transaction ID, signup date and payment status | United States |
Subprocessor controls
- Before sharing student data, we confirm that each subprocessor can maintain appropriate security and obtain written assurances to that effect.
- Each subprocessor is bound by written obligations at least as protective as our agreements with schools and districts.
- We remain responsible for the acts and omissions of our subprocessors.
- Schools and districts are notified at least 30 days before a subprocessor is added or changed.
11. Incident Response
MyVirtualTAs maintains a written incident response plan that defines roles, escalation, and communication. The plan is tested at least annually.
- Detection and reporting of a suspected incident.
- Triage and assessment of scope and affected data.
- Containment to stop further exposure.
- Eradication and recovery of affected systems.
- Notification of affected schools, districts, and users.
- Post-incident review and corrective actions.
Notification: We notify the affected school or district's designated security contact promptly, and in no case more than 72 hours after confirming a data breach, unless a law enforcement authority directs us to delay.
The notification includes, as information becomes available:
- A general description of the breach.
- The categories and approximate number of records or individuals affected.
- The steps taken to remediate the breach.
- An estimated timeline for any details not yet available.
We cooperate with the school or district's reasonable requests, take steps to mitigate harm, and keep records of every incident. A summary of the incident response plan is available to partner schools and districts under a non-disclosure agreement.
12. Law Enforcement Requests
If MyVirtualTAs receives a request for student data from a law enforcement or other legally authorized entity, we promptly notify the school or district that owns the data, unless the law prohibits that notice.
13. Data Retention, Return and Deletion
| Data / Event | Retention and Deletion |
|---|---|
| Session recordings | Permanently deleted 90 days after the session date. |
| Account and learning data | Kept for the duration of the school or district agreement. |
| Security logs | Kept for 90 days, then deleted. |
| Written deletion request from a school or district | Deleted within 30 days of the request. |
| End of agreement | Deleted within 90 days of termination. |
| Free or trial accounts | Deleted after 90 days of inactivity. |
| Backups | Deleted data is removed from backups as they expire, within 90 days. |
- Deletion covers all copies, including backups, temporary files, and data held by subprocessors.
- On request, a written certificate of deletion is provided within 30 days of deletion.
- Before deletion, schools and districts can export their data, or we return it in CSV or XLSX format within 90 days of termination.
- If the law requires us to keep any data, we notify the school or district in writing within 30 days of termination and continue to protect that data under this plan.
14. Backup and Recovery
Databases are backed up monthly. Backups are encrypted, kept for 90 days, and stored separately from production systems. Restores are tested annually.
15. Training and Security Awareness
All employees, tutors, and contractors with access to student data complete security and student-privacy training at onboarding and at least annually. Training covers:
- FERPA, COPPA, and the confidential handling of student data.
- Protecting account credentials.
- Recognizing phishing and social engineering.
- Reporting suspected security incidents immediately.
Completion records are kept for every person.
16. Program Review
The Security Coordinator evaluates this plan at least annually. Updates address the results of the risk assessment and security testing, new technologies, and any change that could affect the protection of student data. Updates are approved by management and communicated to all personnel. We do not reduce the level of protection given to student data during the term of any school or district agreement.
17. Security Contact
To report a security concern or request information about this plan, contact:
Security Coordinator: Stefani Resseguie
Email: stefani@eurekii.com