Last updated: July 11, 2026
This page answers the questions we're asked most often during a district's vendor security review. For anything not covered here, reach out — we're happy to complete a custom questionnaire directly.
Where is Model B hosted? Vercel (application) and Supabase (database, authentication, file storage), both established infrastructure providers with their own security programs.
What security framework does Model B follow? Practices are informed by the NIST Cybersecurity Framework (CSF) 2.0. Full detail is in our Security Overview.
Does Model B have SOC 2 or ISO 27001 certification? Not yet. We're an early-stage company and haven't pursued formal third-party certification. We'd rather be direct about that than imply a certification we can't back up with an audit report.
What data does Model B collect? Account information, student directory-type data (name, ID, grade, homeroom), and operational records generated through normal use of whichever modules your school has enabled. Full detail is in our Privacy Policy and Data Retention & Deletion page.
Does Model B collect parent or guardian data? No, not currently.
Does Model B sell data or use it for advertising? No, never.
Who are Model B's subprocessors? See our Subprocessors page — kept current as the single source of truth.
How is access controlled? Role-based, least-privilege, enforced at the database layer using PostgreSQL Row Level Security — not application logic alone.
Can Model B staff access our data? Only for support and platform operation purposes, using the same role-based view your own users would see — never more. This access is logged: who, which account, when, and for how long.
How is substitute/guest access handled? No standing account is created. Access is time-boxed, individually revocable, and scoped only to the specific classroom(s) being covered. Every action is individually logged.
How are passwords handled? Hashed, never stored in plaintext, never viewable by anyone including Model B. Checked against a breach database at sign-up and reset using a method that never transmits the actual password.
Does Model B back up data? Yes — automated nightly backups of all production data and uploaded files, stored with a separate provider (Cloudflare), retained on a rolling 30-day basis with separate access credentials from the application itself.
What happens if there's a security incident? Affected schools are notified without unreasonable delay after we confirm an incident, and we cooperate with your school's own notification obligations under FERPA and applicable law.
Will Model B sign a Data Privacy Agreement? Yes — we're prepared to execute the TX-NDPA, the standard agreement maintained by the Texas Student Privacy Alliance, rather than a bespoke agreement.
Does Model B comply with FERPA? Model B operates as a "school official" under FERPA. See our FERPA Commitment page for detail.
Reach us at hello@modelb.app — we're glad to walk through anything specific to your district's review process.