Trust & security

Trust, security and compliance

Schools entrust KiwiBee with data about teachers, students and families. This page explains how we protect it.

Last updated: 2026-10-04

Security overview

HSTS preload
Strict-Transport-Security with preload directive. Browsers only ever connect to KiwiBee over HTTPS.
Cross-origin policies
Cross-origin policies restrict access while allowing sign-in popups.
Permissions Policy
Browser permissions are restricted by default. Selected classroom tools can request microphone access.
Clickjacking protection
X-Frame-Options: SAMEORIGIN prevents external sites from embedding KiwiBee in an iframe.
MIME-type pinning
X-Content-Type-Options: nosniff stops browsers from guessing content types.
Referrer policy
Referrer-Policy: strict-origin-when-cross-origin minimizes data leaked to third-party domains.
Content Security Policy
Content Security Policy restricts resource sources; permitted inline scripts and styles remain enabled.

Where we stand on each major framework today.

SOC 2
We plan to pursue a SOC 2 audit. No audit is under way yet. Ask us for our current security overview.
Planned
GDPR
Contact us to discuss data-processing terms and available documentation.
Under review
FERPA
For US schools, KiwiBee acts as a school official under the school's direct control and uses student records only to provide the service.
Aligned
COPPA
Designed to support schools' COPPA obligations: the school provides consent for students under 13, and we collect only what the service needs. A separate parental-consent flow is in development.
Supported
Vietnam data protection
Current requirements are under review. No verified compliance claim is made.
Under review

The third-party providers we use to deliver the service.

Provider	Purpose	Region
Supabase	Database, file storage and server functions	Singapore
Vercel	Web hosting, edge network and AI gateway for the website chatbot	Global edge
OpenAI	AI drafting, images and transcription; retention depends on the workflow.	US
Mistral	Website chatbot, document reading (OCR) and some teacher tools	EU
ElevenLabs	Text-to-speech audio	US
Google	Sign in with Google, Workspace email and Analytics	Global
Stripe	Payments and billing	US
Resend	Transactional email	US
Apple and Google	Mobile push notifications	Global

Where customer data lives at rest.

Default region

Singapore (Supabase Asia-Southeast region)

Other regions

Customer data is stored in Singapore today. Other regions are not available yet.

Found a security issue? We'd love to hear from you.

Acknowledgement

Within 24 hours

Initial response

Within 7 days

Coordinated disclosure

90 days from initial report

Other documents that shape how KiwiBee handles data.

What we collect, why, and how to manage your preferences.

The agreement that governs use of the platform.

Accessibility

Our WCAG 2.2 conformance statement and contact details.

Procurement, security or DPO teams can reach our team directly for evidence packs and questionnaires.