Security Policy

Effective Date: July 1, 2026
Last Updated: July 2026
Version: 2026-07
Entity: EverJoy Memory LLC d/b/a EverJoy

1. Purpose and Scope

This Security Policy describes EverJoy's information security program for protecting personal information processed through The AI-Powered Student Growth Cloud. It applies to:

All EverJoy systems, applications, and infrastructure
Employee, contractor, and Capture Partner access to systems
Third-party service providers (Subprocessors)
Physical and environmental security controls

This Policy supports representations in the Privacy Policy, District DPA, and Data Retention Policy.

2. Security Governance

2.1 Responsibility

Role	Responsibility
Executive Leadership	Security program oversight, resource allocation
Security Lead	Policy maintenance, incident response coordination
Engineering	Secure development, infrastructure security
Operations	Monitoring, access management, vendor oversight

Security contact: security@myeverjoy.com

2.2 Policy Review

This Policy is reviewed at least annually and updated following:

Material security incidents
Significant infrastructure changes
Regulatory or compliance updates
Third-party audit findings

2.3 Risk Assessment

EverJoy conducts periodic risk assessments covering:

Data classification and inventory
Threat modeling for critical workflows (auth, capture, AI)
Vendor/subprocessor security review
Vulnerability assessment

3. Data Classification

Classification	Description	Examples	Handling
Critical	Highly sensitive personal data	Child photos, roster DOB, capture artifacts	Encrypted, RLS, audit logged, signed URLs
Confidential	Personal information	Parent email, child names, billing	Encrypted, access controlled
Internal	Business operations	Analytics aggregates, system logs	Access restricted to personnel
Public	Marketing content	Landing pages, public school directory	No restrictions

4. Access Controls

4.1 Authentication

Supabase Auth for user authentication
Email/password with email verification required for dashboard access
Session tokens managed via secure HTTP-only cookies
Session middleware validates authentication on protected routes (yearbox/src/lib/supabase/middleware.ts)

4.2 Authorization Model

EverJoy implements role-based access control with row-level security (RLS):

Role	Access Scope
Parent	Own family data via `family_id`, `owns_student()`
Family member	Shared content via `is_family_member()`
Capture Partner	Assigned schools via `partner_serves_school()`
School admin	School-scoped data (future admin portal)
Platform admin	Full access via `is_platform_admin()` with audit logging

4.3 Row-Level Security (RLS)

RLS is enabled on all major tables per migration 00008_rls_policies.sql and feature-specific migrations:

Parents cannot SELECT from student_roster
Partners cannot access schools outside assignments
Family data isolated by family_id
Admin bypass requires platform_admin role

4.4 Least Privilege

Production database access restricted to service role in server-side code only
Anon key used for client with RLS enforcement
Admin console requires platform_admin role
Partner portal requires capture_partner role

4.5 Access Reviews

Platform admin access reviewed quarterly
Partner certifications renewed annually
Terminated employee/contractor access revoked within 24 hours

5. Encryption

5.1 Encryption in Transit

All external communications use TLS 1.2 or higher
HTTPS enforced for all web traffic
API calls to Supabase, Stripe, OpenAI use TLS
HSTS enabled for production domain

5.2 Encryption at Rest

Database encryption via Supabase/cloud provider (AES-256)
Storage bucket encryption via Supabase Storage
Backup encryption per cloud provider standards

5.3 Key Management

API keys stored in environment variables (not in source code)
Production secrets managed via Vercel/hosting environment
Keys rotated upon personnel changes or suspected compromise
Separate keys for development, staging, production

6. Storage Security

6.1 Private Storage Buckets

Memory files and child photos stored in private buckets (migration 00037_private_storage_buckets.sql):

Bucket	Contents	Access
`memories`	Uploaded photos, PDFs	Signed URL after auth
`student-photos`	Child profile photos	Signed URL after auth
`capture-artifacts`	Partner-scanned work	Signed URL after auth

6.2 Signed URLs

Files are never publicly accessible. Access requires:

Authenticated user session
Authorization check (owns student, family member, or partner assignment)
Short-lived signed URL generation

Context	TTL
UI display	1 hour
AI processing	15 minutes

Implementation: yearbox/src/lib/storage/signed-urls.ts

6.3 Storage Access Logging

Storage access is logged via application audit logs when files are accessed through authorized endpoints.

7. Application Security

7.1 Secure Development

TypeScript for type safety
Code review required for production changes
Dependency vulnerability scanning
Environment separation (development, staging, production)

7.2 Input Validation

Server-side validation on all API routes
Parameterized database queries (Supabase client)
File type validation on uploads
Rate limiting on sensitive endpoints

7.3 Rate Limiting

Endpoint	Limit
Roster activation	5 failures per 24 hours per account
API routes	Per-route limits (implementation-specific)
Auth attempts	Supabase Auth defaults

7.4 Error Handling

Generic error messages to users (no stack traces)
Roster verification errors do not reveal whether student exists
Detailed errors logged server-side only

7.5 Beta Mode

Production beta gating via EVERJOY_BETA_MODE limits signup to controlled rollout (yearbox/src/lib/beta/config.ts).

8. Audit Logging

8.1 Audit Log Design

Append-only audit_logs table (migration 00006_audit_logs.sql):

Database triggers prevent UPDATE and DELETE
Records action, table, record ID, actor, timestamp, metadata

8.2 Logged Events

Event	Action
Consent acceptance	`consent_records` INSERT
Student creation	`students` INSERT
Roster activation	Activation attempt
Memory deletion	`memories` DELETE
School interest	`school_interest` INSERT
Admin actions	Platform admin operations

Implementation: yearbox/src/lib/audit/log.ts

8.3 Retention

Audit logs retained for 3 years (1,095 days) per Data Retention Policy.

8.4 Monitoring

Admin console access to audit logs
Alerts for anomalous patterns (future enhancement)

9. Infrastructure Security

9.1 Hosting

Application hosted on Vercel
Database and storage on Supabase (PostgreSQL)
CDN and DDoS protection via Vercel/Cloudflare

9.2 Network Security

No direct database exposure to internet
API routes server-side only for sensitive operations
Service role key used only in server environment

9.3 Environment Separation

Environment	Purpose	Data
Development	Local development	Test/synthetic data
Staging	Pre-production testing	Anonymized data
Production	Live service	Real user data

Production credentials never used in development.

10. Third-Party Security

10.1 Subprocessor Requirements

Subprocessors must:

Maintain appropriate security certifications (SOC 2, ISO 27001 where applicable)
Provide data processing agreements
Notify EverJoy of security incidents
Support audit requests

10.2 Subprocessor List

See District DPA Exhibit A for current subprocessors:

Supabase (database, auth, storage)
Stripe (payments)
OpenAI (AI processing)
PostHog (analytics)
Postmark/SendGrid (email)
Vercel (hosting)

10.3 Vendor Review

Subprocessors reviewed:

Before initial engagement
Annually thereafter
Upon security incident notification

11. Capture Partner Security

11.1 Partner Certification

Capture Partners must complete:

EverJoy Partner Academy training
FERPA/COPPA awareness module
Background check (where required by law)
Confidentiality agreement

Training content: yearbox/src/lib/partner-capture/academy/content.ts

11.2 Partner Access Controls

Partner portal (/partner/*) requires capture_partner role
Access scoped to assigned schools only
Partners cannot browse roster data
Student identity via QR/barcode scan only

11.3 Capture Authorization

Capture requires:

School agreement with capture_authorized = true
Parent booklet enrollment
Valid partner assignment

Implementation: yearbox/src/lib/partner-capture/capture-authorization.ts

12. AI Security

See AI Usage Policy for details. Summary:

AI worker endpoint protected by AI_WORKER_SECRET
OpenAI API key server-side only
Signed URLs for file access (15-minute TTL)
Monthly cost cap ($200) prevents runaway processing
Consent required before AI processing

13. Incident Response

13.1 Incident Classification

Severity	Description	Response Time
Critical	Data breach, system compromise	Immediate
High	Unauthorized access attempt, service outage	1 hour
Medium	Vulnerability discovered, suspicious activity	4 hours
Low	Policy violation, minor misconfiguration	24 hours

13.2 Response Procedure

Detection — Monitoring, user report, vendor notification
Containment — Isolate affected systems, revoke compromised credentials
Investigation — Determine scope, affected data, root cause
Notification — Notify affected users, districts, regulators per legal requirements (72 hours for District DPA)
Remediation — Fix vulnerability, restore services
Review — Post-incident analysis, policy updates

13.3 Breach Notification

EverJoy will notify:

Affected users without undue delay
District customers within 72 hours (per DPA)
Regulatory authorities as required by applicable law (e.g., California AG for breaches affecting 500+ California residents)

Notification includes: nature of incident, data affected, steps taken, recommended user actions.

13.4 Incident Contact

Report security incidents to: security@myeverjoy.com

14. Business Continuity

14.1 Backup

Database backups via Supabase (daily, point-in-time recovery)
Storage redundancy via cloud provider
Configuration stored in version control

14.2 Recovery

Recovery Time Objective (RTO): 4 hours for critical services
Recovery Point Objective (RPO): 24 hours for database
Disaster recovery procedures documented in operations runbook

14.3 Availability

Target uptime: 99.5% (excluding scheduled maintenance).

15. Personnel Security

15.1 Background Checks

Background checks for personnel with access to production systems or child data, where permitted by law.

15.2 Training

Security awareness training at onboarding
Annual refresher training
Role-specific training (admin, partner certification)

15.3 Confidentiality

All personnel and contractors sign confidentiality agreements covering personal information.

15.4 Offboarding

Upon termination:

Access revoked within 24 hours
Equipment returned
Confidentiality obligations continue

16. Compliance

16.1 Regulatory Alignment

Security controls support compliance with:

FERPA — Education records protection
COPPA — Children's online privacy
SOPIPA — California student online privacy
CCPA/CPRA — California consumer privacy
PCI-DSS — Payment card security (via Stripe)

16.2 Accessibility

Security controls do not impede accessibility. EverJoy commits to WCAG 2.1 AA alignment for user-facing interfaces (see production readiness checklist).

17. User Responsibilities

Users contribute to security by:

Using strong, unique passwords
Not sharing account credentials
Reporting suspicious activity to security@myeverjoy.com
Keeping contact information current
Reviewing Family Circle sharing permissions

18. Policy Updates

Material changes to this Policy will be communicated via:

Email to registered users (for user-impacting changes)
Update to Policy version and effective date
Notification to district customers (for DPA-relevant changes)

19. Contact

Purpose	Contact
Security incidents	security@myeverjoy.com
Privacy inquiries	privacy@myeverjoy.com
General support	support@myeverjoy.com

Schedule A: Security Control Matrix

Control ID	Domain	Control	Implementation	Status
AC-1	Access Control	Role-based access	RLS + user_role enum	✅
AC-2	Access Control	Least privilege	Scoped policies	✅
AC-3	Access Control	Session management	Supabase Auth	✅
AC-4	Access Control	Admin access review	Quarterly	🔄
SC-1	System & Communications	TLS 1.2+	HTTPS enforced	✅
SC-2	System & Communications	Encryption at rest	Cloud provider AES-256	✅
SC-3	System & Communications	Signed URLs	1h UI / 15min AI	✅
SC-4	System & Communications	Key management	Environment variables	✅
AU-1	Audit	Append-only logs	DB triggers	✅
AU-2	Audit	Event coverage	Partial (see checklist)	🔄
AU-3	Audit	Log retention	3 years	✅
IR-1	Incident Response	72-hour notification	DPA commitment	✅
IR-2	Incident Response	Incident playbooks	Documented	✅
CP-1	Contingency Planning	Daily backups	Supabase	✅
CP-2	Contingency Planning	RTO 4 hours	Target	✅
IA-1	Identification & Authentication	Email verification	Required	✅
IA-2	Identification & Authentication	Rate limiting	Roster activation	✅
CM-1	Configuration Management	Environment separation	Dev/staging/prod	✅
CM-2	Configuration Management	Secret rotation	On compromise	✅

Schedule B: Penetration Testing

EverJoy conducts security assessments:

Assessment Type	Frequency	Scope
Dependency scanning	Continuous	npm packages
Code review	Per PR	Changed code
Penetration test	Annual	Production environment
RLS policy audit	Quarterly	Database policies

Results shared with District upon request under NDA.

Schedule C: Security Training

Audience	Training	Frequency
All personnel	Security awareness	Onboarding + annual
Engineering	Secure development	Onboarding + annual
Capture Partners	FERPA/COPPA + capture security	Certification
Platform admins	Admin access responsibilities	On role assignment

Security Policy version 2026-07. Aligned with EverJoy infrastructure in yearbox/supabase/migrations/ and security implementations.