Skip to content

TalkingPoints Security Overview

Effective October 24, 2026
Please also reference our updated Privacy Policy

Overview

Educators and families trust TalkingPoints with important and sensitive information. Our security approach consists of six critical components that allow us to maintain data security and integrity for entry, transfer, storage, and access.

    • Corporate governance
    • Physical security
    • Environmental security
    • Software security
    • Children’s data, de-identification, and retention
    • Regulatory compliance

Each of these will be described in more detail.

Corporate governance

    • TalkingPoints works with industry-leading advisors to review and guide our policies and procedures.
    • All TalkingPoints employees and contractors sign agreements that require them to preserve and protect the confidentiality of sensitive information they may access while doing their jobs.
    • All TalkingPoints employees are scrutinized by mandatory background checks.
    • Employees are required to enable two-factor authentication in every internal and external service where two-factor authentication is made available and practical.
    • All computers and mobile devices issued by TalkingPoints, as well as any software that runs on those machines, are password-protected and encrypted where possible.
    • All employees receive privacy and security training at least annually.

Physical security

TalkingPoints strictly controls physical access to user information.

    • All TalkingPoints premises require key entry.
    • Personally identifiable information is not stored onsite.
    • All work computers and laptops provided to TalkingPoints personnel have encrypted disks.

Environmental security

TalkingPoints uses Google Cloud Platform (GCP) and other third-party services in the GCP environment to host and operate our databases.

GCP is an industry-leading cloud service platform that provides nondescript facilities, professional security staff, controlled access, video surveillance, intrusion detection, and other security features. All data is separated from outside connections, and access is limited to select members of the current TalkingPoints team.

TalkingPoints stores its data within a GCP region that is FedRAMP compliant.

TalkingPoints’s main database and all backups are encrypted at rest.

The GCP cloud infrastructure has been designed and managed in compliance with regulations, standards, and best practices, including HIPAA, SOC 1/SSAE 16/ISAE 3402 (formerly SAS70), SOC 2, SOC 3, PCI DSS Level 1, ISO 27001, FedRAMP, DIACAP and FISMA, ITAR, FIPS 140-2, CSA, and MPAA.

Learn more about Google Cloud’s security practices at cloud.google.com/security.

Software security

TalkingPoints’s infrastructure is built on industry-tested technology and security practices.

    • TalkingPoints uses encryption, firewall, and network security software.
    • TalkingPoints uses single sign-on (SSO).
    • Low-level auditing software is supported for all external providers (GCP, Atlas) to record potentially malicious actions that may take place.
    • TalkingPoints runs periodic penetration tests, then logs and resolves discovered issues.
    • All TalkingPoints clients use TLS/SSL when communicating with our servers.
    • TalkingPoints has a host-based intrusion detection system to detect unauthorized access to production hosts.
    • Audit logs are sent to a central location for storage and analysis. Access to production servers and interaction with production systems is audited and logged.

If we learn of a security breach, TalkingPoints will notify affected users as required by applicable laws and may post a notice on our services as required by applicable laws. We will then investigate the breach and make any necessary technical enhancements to resolve the security vulnerability.

TalkingPoints has designated a Security Incident Response team consisting of the Heads of Product, Operations, Engineering and Data departments. In the event of a data breach, this team will coordinate the response with internal TalkingPoints teams. The Security Incident Response Team can be reached at security@talkingpts.org.

Children’s data, de-identification, and retention

TalkingPoints maintains a written information security program that expressly covers children’s personal information, with safeguards appropriate to the sensitivity of the information collected and to TalkingPoints’ size, complexity, and the nature and scope of its activities, consistent with the amended Children’s Online Privacy Protection Rule. A designated coordinator oversees the program, risks are assessed annually, and safeguards are updated based on those assessments.

    • Access to student personal information is restricted to personnel who need it to perform their roles, and access to expanded academic data categories shared under a written agreement is further restricted to the program team.
    • Student personal information is retained only as long as reasonably necessary for the purpose for which it was collected and is never retained indefinitely. Deletion and end-of-service schedules are described in Section 6 of the Privacy Policy and in executed district agreements, which control in the event of any conflict.
    • Where TalkingPoints creates or uses de-identified data, direct and indirect identifiers are removed such that a student’s identity is not personally identifiable, consistent with the standard under FERPA. TalkingPoints does not attempt to re-identify de-identified data and contractually prohibits its vendors from doing so.
    • Published aggregate reporting applies a minimum cell size of 10 and suppresses or aggregates small populations to prevent identification of any individual. Re-identification risk for de-identified and aggregate data sets is reviewed annually.

Regulatory compliance

TalkingPoints works with policy advisors to ensure that our product and practices remain compliant with relevant mandates and regulations.

    • TalkingPoints meets COPPA legislative requirements.
    • TalkingPoints helps schools comply with federal FERPA regulations.
    • TalkingPoints supports school and district compliance with state student data privacy laws, including through execution of state and district data privacy agreements.