Trust Center
BlueBird Alerts & BlueBird Guardian • Last updated: October 19, 2026
Security
- Per-school (tenant) isolation: school-scoped stores and server-side authorization checks restrict access to the intended school.
- Encryption: TLS in transit; sensitive student data (browsing URLs, search terms, flagged keywords, file names) is encrypted at rest.
- Access control: role-based admin access with least privilege; two-factor authentication (TOTP) and passkeys are available for all administrator accounts.
- Auditability: administrative actions are recorded in a hash-chained activity log for each school that blocks edits; entries older than two years move to an archive file. Sign-in attempts and lockouts are recorded in a separate platform security log.
- Infrastructure: US-hosted, behind Cloudflare (WAF/DDoS), with error monitoring, off-site database replication over HTTPS, and an encrypted daily backup.
Privacy & monitoring scope (Guardian)
BlueBird Guardian runs only on school-managed devices after a school IT administrator explicitly deploys it. Here is what it records today:
- We capture: each web address visited and its site, the signed-in Google account email, basic device identity and network address, any matched policy or safety keyword, details of file uploads to other websites (file names and sizes, not file contents), screenshots of the active tab when school staff request them, and per-student activity baselines that Guardian computes each night for every school with Guardian. If a school creates data-loss-prevention rules, Guardian also records matches to those rules. See the Privacy Policy for the full list.
- Monitoring scope: activity events and DLP metadata do not intentionally collect passwords, cookies, or request/response bodies. Screen monitoring is included for every school with the Guardian add-on, and there is currently no separate setting to turn it off. Signed-in school staff with Guardian console access, including teacher and staff accounts, can request a screenshot of the tab a student is viewing. They can also start a class monitoring session that captures each included device's active tab at the interval they choose (at most about once a minute) until they end the session. Students see an orange dot on the Guardian icon during a monitoring session (when the icon is shown in the browser toolbar); a single screenshot request shows no indicator. Screenshots skip Google, Microsoft and Apple sign-in pages and any sites the school excludes, and otherwise show whatever is visible in that tab. Screenshots are encrypted at rest and deleted by a daily cleanup once they are 24 hours old. Schools should cover this in their monitoring policy.
- Retention: activity is retained for a school-configurable window (90 days by default) and then automatically purged.
Responsible AI
Guardian's anomaly detection is statistical (per-student baselines and standard-score outliers). It does not use an AI language model.
Two optional Guardian features use an AI language model. Both stay off until a school administrator turns them on:
- Risk levels for safety flags. When a safety keyword is flagged, the model receives the flagged web address (which can include search terms), its site, the matched keyword, the student's 10 most recently visited sites and the number of flags in the last 14 days. It suggests a severity level. It is not sent page text, page titles, screenshots, or the student's name or email as a separate field, but a web address can contain personal details. School staff review the results. If the school also turns on escalation, the most severe results automatically notify the contacts the school has chosen.
- Site categories. The model receives only a website's domain name (for example, example.com) seen on school devices and suggests a filter category. If the school turns on automatic proxy blocking, sites identified as filter-bypass proxies are blocked.
In our current setup these Guardian features run on an AI model hosted on hardware BlueBird operates, reached over an encrypted private network, and not on a third-party AI service. We do not use Guardian data to train AI models. Other features that use a third-party AI service are listed under Subprocessors.
Subprocessors
| Provider | Purpose | Data |
|---|---|---|
| Vultr | Application server and databases | All service data |
| Cloudflare | CDN, WAF/DDoS, database replication (R2) | Network traffic; database replicas (sent over HTTPS) |
| Apple (APNs) | iOS push notifications | Device push tokens and notification payloads |
| Google (FCM) | Android push notifications | Device push tokens and notification payloads |
| Twilio | SMS alerts (when enabled) | Phone numbers, message text |
| SendGrid | Transactional email | Email addresses, message text |
| Sentry | Error monitoring | Diagnostic/error metadata |
| Polar | Online purchases and billing | Purchaser contact details and payment status |
| Google Workspace | Directory sync and Google sign-in, when your school connects it | Directory and sign-in account details from your school's Google Workspace |
| Anthropic | AI drafting and text extraction for optional features: signage announcement drafts, Legacy Wall records import, and incident summaries | Text an administrator types, text from a public web page the school imports, and alert text with staff names. In our current setup, Guardian student browsing data is not sent to Anthropic. |
Compliance
- We operate as a School Official under FERPA, processing data only to perform the educational functions your school directs.
- Designed for COPPA alignment (school-authorized use) and to support CIPA web-filtering requirements.
- Contact us to review your school's Student Data Privacy Agreement.
Vulnerability disclosure
Found a security issue? Email [email protected]. We welcome good-faith reports and will not pursue researchers who follow responsible disclosure. See /.well-known/security.txt.
Breach notification
If a security incident affects your data, we will notify the affected school without undue delay and within any timeframe your agreement or state law requires (e.g., New York Education Law 2-d's 7-day window), including the scope, data types, and remediation status.
Contact
Sales: [email protected] • Support & privacy: [email protected] • Security: [email protected]