Security
Daycares keep information about children in ChildCare Kiosk, so we have built it to protect that information. This page describes what the service does today. It is not a certification, and we do not claim one.
Where the service runs
- The application runs on Google Cloud Run in Google's us-east1 region (South Carolina, United States).
- Records are stored in a managed PostgreSQL database run by Neon.
- Uploaded documents and backup archives are stored in Cloudflare R2 object storage.
- The full list of companies that process data for us is on the Privacy page.
Encryption
- In transit: the service is served over HTTPS, and browsers are told to use HTTPS only for this site (HSTS). Sign-in cookies are only sent over HTTPS.
- Sensitive fields: children's allergies and medical notes, notes on pick-up contacts and documents, and immunization exemption reasons are encrypted by the application before they are written to the database. The keys are kept apart from the database.
- Backups: each backup archive is encrypted before it leaves the application, with a key separate from the one used for those fields. In production a backup will not run at all without that key, rather than be written unencrypted.
Each daycare's records are kept apart
Every record belongs to one account. The application checks this on every request, and the PostgreSQL database enforces it a second time with row-level security, so a request made for one account cannot read another account's records even if a check in the application were missed. The application connects to the database with a role that cannot bypass those rules.
Access control
- Each person signs in with their own email and password. Each role (for example provider, director, teacher, staff or parent) sees only what that role allows, and can be limited to one location.
- The tablet at the door signs in as the location. A PIN typed on the tablet roster opens staff actions for 60 seconds (or until Lock), and the admin dashboard PIN does not open roster edits or form deletes. The admin dashboard locks after 15 minutes without admin activity.
- Passwords and PINs are stored only as one-way hashes. Repeated wrong passwords or PINs lock further attempts for a while.
- Sign-ins and important changes (for example invitations, removed access, data exports and account closure) are recorded in a security log.
- Our operator console manages accounts and access, and shows an activity log of each account (sign-ins, changes, and which pages and buttons are used, never what is typed). It has no feature for signing in as a daycare. Our staff with access to the underlying systems use it only to keep the service running, to help when a daycare asks us to, or when the law requires it.
In the browser
Our pages load scripts only from our own site, cannot be framed by another site, and signed-in pages are not stored in the browser's cache, so the back button on a shared device does not reveal a child's record.
Uploaded files
Uploads are limited to PDF files and common photo formats, and a file's contents must match the type its name says. Every upload is scanned for malware before it is saved. If the scanner is not available, the upload is refused rather than saved unscanned.
Backups and recovery
- Each account's records and uploaded files are backed up by a scheduled job once a day into an encrypted archive.
- A backup only counts as successful after it has been checked for completeness. Stored archives are read back and checked once a week.
- Archives are kept for 30 days, and the three most recent good backups of an account are always kept.
- The database provider keeps its own point-in-time recovery history in addition to these archives.
- We have tooling to restore one account from its archive, and we rehearse it on test copies of the data.
Deleting data
When an account is closed and its grace period has passed, its records, uploaded files and backup archives are erased. The details are on the Privacy page.
Reporting a security problem
If you believe you have found a security problem, please tell us at security@childcarekiosk.com. Please include enough detail for us to reproduce it, and give us a reasonable time to fix it before telling anyone else. Do not access, change or delete other people's data while testing. Our contact for security reports is also published at /.well-known/security.txt.
Contact
For other questions, use the contact page or write to info@childcarekiosk.com.