Information Security Policy

Our top-level commitment to protecting the confidentiality, integrity, and availability of the information we hold.

Document owner: Oscar Ramos
Approved by: Eli Johnson, Product Manager
Version: 1.0
Approved date: 9/21/2026
Next review: 9/21/2027
Applies to: Founders, Co-Founders, Designers, Head of Education Partnerships, and Software Developers

1. Purpose

This policy sets Ladderly Learning’s commitment to protecting the confidentiality, integrity, and availability of the information we hold — especially the student education records entrusted to us by the schools and districts we serve. It is the top-level policy from which our other security policies derive.

2. Scope

This policy applies to all information Ladderly Learning creates, receives, stores, or transmits, in any form, and to everyone who accesses our systems or data. It covers all company-managed devices, cloud services, networks, and applications.

3. Our role and legal context

Ladderly Learning processes student data as a “school official” under FERPA on behalf of our customer schools. This means we:

use student data only for the purposes authorized in our contract with each school;
remain under the direct control of the school with respect to the use and maintenance of education records;
do not re-disclose student data except as the school authorizes or the law permits; and
protect the data with appropriate administrative, technical, and physical safeguards.

4. Guiding principles

Least privilege — people get the minimum access needed to do their jobs.
Defense in depth — no single control is relied on alone.
Data minimization — we collect and keep only what we need, for only as long as we need it.
Accountability — every system and data set has a named owner.

5. Roles and responsibilities

Executive leadership approves this policy, funds the security program, and owns overall risk.
The Security Officer maintains the security program, this policy set, risk assessments, and the incident response process, and reports to leadership.
All personnel follow these policies, complete required training, and report suspected security or privacy incidents immediately.

6. Information classification

At minimum, Ladderly Learning classifies data as:

Restricted (including FERPA) — student education records / PII, credentials, secrets. Strongest controls; encryption in transit and at rest; access strictly limited and logged.
Confidential — internal business data, employee data, contracts.
Internal — day-to-day internal information not intended for the public.
Public — information approved for public release.

Handling rules for each level are defined in the Access Control, and Data Retention & Disposal policies.

7. Core control areas

Access control. Access is granted on least-privilege, role-based principles, reviewed periodically, and removed promptly on role change or departure. See the Access Control Policy.

Encryption. Restricted and Confidential data is encrypted in transit (TLS) and at rest.

Change & vulnerability management. Changes to production systems are reviewed and tracked. Systems are patched on a defined schedule; vulnerabilities are triaged and remediated by severity.

Logging & monitoring. Access to systems holding student data is logged. Logs are retained and monitored for suspicious activity.

Vendor / subprocessor management. Third parties that process student data on our behalf are vetted for security

Business continuity & backups. Critical data is backed up.

Physical security. Physical media are secured; production infrastructure is hosted with reputable providers (GCP) that maintain their own physical safeguards.

8. Security awareness training

All personnel complete security and privacy awareness training — including FERPA and student-data handling — at onboarding and at least annually. Completion is recorded.

10. Incident response

Suspected or confirmed security or privacy incidents must be reported immediately to the security officer. Ladderly Learning follows its Incident Response Plan, which includes procedures for notifying affected schools so they can meet their own obligations to students and families.