---
title: Security overview
category: procurement
order: 2
lastUpdated: 2026-06-08
featureAvailability: GA
roles: [district-admin, admin]
relatedArticles: [security/data-encryption, security/access-controls, security/incident-response, procurement/subprocessors, procurement/identity-sso]
---

## At a glance

- **Who uses it:** District IT and security reviewers.
- **Purpose:** One-page summary of AmplifyED's security posture for procurement.

## Hosting & data location

- US-based managed cloud hosting.
- Single-tenant database with multi-tenant logical isolation enforced via Postgres row-level security on `organization_id`.
- No student data is transferred outside the United States.

## Encryption

- **In transit:** TLS 1.2+ on all surfaces; HSTS enabled.
- **At rest:** AES-256 at the storage layer for the primary database and object storage.
- **Application-level encryption:** Sensitive integration credentials (LMS access tokens, SAML signing material) are application-encrypted on top of database-level encryption.

See [Data encryption](/help/security/data-encryption).

## Authentication

- Email + password with bcrypt hashing.
- Google and Microsoft sign-in (OIDC).
- SAML 2.0 SSO (Okta, OneLogin, ADFS, generic IdP).
- Failed-login protection: account lockout after 3 consecutive failures.
- All session tokens are HTTP-only and rotated on sign-in.

See [Identity & SSO](/help/procurement/identity-sso).

## Authorization

- Triple-gated access control: Postgres RLS + server-side middleware + application assertion helpers. Every server function verifies the caller's `organization_id` membership.
- Role hierarchy: super admin / district admin / school admin / facilitator / teacher.
- No client-side role checks — every authorization decision is enforced server-side.

## Audit logging

Every sensitive action is recorded with actor, action, target, timestamp, IP, user agent, and structured metadata. Searchable and exportable by school and district admins. See [Audit logging](/help/procurement/audit-logging).

## Vulnerability disclosure

We accept good-faith security reports at security@amplifyed.app. See [Vulnerability reporting](/help/security/vulnerability-reporting).

## Compliance

- FERPA-conscious by design (see [FERPA overview](/help/procurement/ferpa-overview)).
- SOC 2 Type II — in progress. Status available on request under NDA.
- Subprocessor list maintained publicly at [Subprocessors](/help/procurement/subprocessors).

## Backups & continuity

- Database backups: daily full + continuous WAL with 30-day point-in-time recovery.
- Object storage: cross-region replication.
- RPO: 1 hour. RTO target: 4 hours for full platform.

## Incident response

24-hour notification for security incidents affecting customer data. See [Incident response](/help/security/incident-response).

## Related articles

- [Data encryption](/help/security/data-encryption)
- [Access controls](/help/security/access-controls)
- [Incident response](/help/security/incident-response)
- [Identity & SSO](/help/procurement/identity-sso)
- [Subprocessors](/help/procurement/subprocessors)
- [Vulnerability reporting](/help/security/vulnerability-reporting)

## FAQ

**Can we get a penetration test report?**
Yes, under NDA. Email security@amplifyed.app.

**Do you support customer-managed encryption keys?**
Not at this time. All keys are managed by AmplifyED's KMS.