Security at Homebook

Updated October 28, 2026

The short version: The school owns its data. Homebook holds less worth stealing (no Social Security numbers, no money), walls every school off inside the database, encrypts data in transit and at rest, never sells or advertises with school data, tells a school right away if something goes wrong, and deletes on a fixed schedule. The binding promises are in the School Data Agreement; this page is the plain-English tour.

What we don’t hold

No Social Security numbers. Homebook never asks for them, so there are none to steal.

No money. Online tuition goes straight from the parent’s card to the school’s own Stripe account, never through ours. EFA and ESA dollars stay with the state’s program manager (ClassWallet in Arkansas and Alabama). We hold no balances, and card numbers never touch our servers.

Every school walled off

Each school’s records are separated by rules in the database itself (row-level security), not just by app code. Those rules are tested before every release and checked automatically every day.

Encryption and sign-in

Data is encrypted in transit and at rest.
Passwords are stored only as hashes.
Documents and photos sit in private storage and open only through short-lived links.
Every Homebook administrative account uses two-step sign-in.

Where the data lives

School data is stored in the United States. The database, sign-in and file storage run on Supabase (on AWS, USA), and the app is hosted on Vercel (USA). The full list of service providers, what each one receives and why, is in the School Data Agreement, Schedule 1, part D. Each one has agreed in writing to protect the data it receives, and Homebook tells schools at least 30 days before adding a provider that receives school data.

Error monitoring (Sentry) is set up to exclude names, emails, records, form contents and IP addresses.

Backups

Backups are encrypted by Homebook before they leave our hands. The storage provider holds only ciphertext and cannot read it; the key is held only by Homebook. Backup copies expire within 30 days, are used only to recover from loss, and are never used to bring back data a school deleted.

Who can see school data

Only Homebook’s members, and the tools Homebook uses to build and fix the service (including the AI assistant named in the agreement), and only to support the school, keep the service running, or fix a problem. Everyone with access is bound to keep it confidential.

What Homebook will never do

Sell or rent school data.
Use school data for advertising, or let anyone else do so.
Build a profile of a student for anything other than the school’s own use of Homebook.
Use school data, including student photos, to train artificial intelligence, or use photos for facial recognition.
Try to re-identify anyone from de-identified data, or sell or share de-identified student data.

If police, a court or a government office asks Homebook for a school’s data, Homebook tells them to ask the school and tells the school right away, unless the law forbids it.

If something goes wrong

If Homebook discovers that someone got into school data who shouldn’t have, Homebook tells the school immediately, with the facts known at the time, and keeps it updated. Even when the facts are still unclear, Homebook contacts the school within 48 hours of first suspecting a problem. Homebook helps the school notify families and government offices as the law requires, and if Homebook or one of its providers caused the breach, Homebook prepares those notices and pays their reasonable cost.

For day-to-day outages, gethomebook.com/status shows live checks of the app, sign-in, the database and email.

Your data, on your schedule

A school can export its data (CSV) at any time, or download a single student’s records.
Records are kept only as long as the published retention schedule allows (Privacy Policy, section 8), and a school may delete sooner at any time.
When a school cancels, it has at least 30 days to export. Seven days before deleting, Homebook emails the director and prepares a full export; then the school’s data is deleted from Homebook. Homebook keeps only what the agreement lists in section 10.4 (what the law requires, its own payment records, and its log of privacy requests), and confirms the deletion in writing on request.

Our security program

Homebook keeps a written information security program and does a risk assessment every year. Once a year, or after a breach, a school may ask for a summary of the program and the latest risk assessment; Homebook answers within 30 days.

Report a security problem

Security contact: Sam Bartolotta, privacy@gethomebook.com, (501) 514-5811. Please include what you found and how to reproduce it.