Loading page…
Last updated: October 22, 2026
This page summarizes how Genius OS protects the data of UnTapped Genius (“UG”) and our partner districts and campuses. We’d rather describe what’s actually in place today, plainly, than overstate it. If you need more detail for a procurement or security review, email us at ug@untappedgenius.org.
Data in transit is encrypted via TLS end to end. Data at rest is encrypted through our hosting and database providers’ standard encryption: MongoDB Atlas for our database and Google Cloud Storage for uploaded files and video. Connected Google service tokens (Drive, Calendar, Sheets) and district single sign-on client secrets are additionally encrypted at the application layer before storage, with support for rotating those encryption keys without invalidating already-stored data. Automated database backups run daily and are stored encrypted, off-site, in storage kept separate from the application’s own files and credentials. The backup job can add a backup but cannot read or delete one, and a retention policy prevents any backup from being deleted or altered before it is 30 days old, after which it is deleted automatically.
Local sign-in uses bcrypt password hashing and a password policy that requires a 12-character minimum and screens against known-breached passwords, without requiring periodic forced password changes, consistent with current NIST guidance (SP 800-63B). Sign-in attempts are throttled per account and per IP address to limit password guessing, and every login attempt is logged with a reason code, without ever logging the password itself. Account deactivation takes effect immediately, on the next request, rather than waiting for a session to expire. Single sign-on is available through Google and, per district, through the district’s own identity provider (Entra ID, Okta, or a standard OIDC provider).
Multi-factor authentication (TOTP-based, with recovery codes) is built into the platform and is in the process of being rolled out to privileged UG staff accounts. It is not yet enforced platform-wide; we’d rather say that plainly than imply otherwise.
Genius OS uses role-based access control with four roles: admin, UG leadership, consultant, and district leader. Access is checked in two independent layers: a session check at the network edge, and a server-side authorization check, re-validated on every data-changing action, not just on page load. District and campus leaders are further scoped to only the district(s) or campus(es) they’re assigned to. A request for data outside a user’s scope returns a not-found response rather than an access-denied one, so the system doesn’t confirm a record exists to someone who isn’t entitled to see it.
Authentication events (success and failure, with a reason code, IP address, and user agent) are recorded separately from general application activity. A consolidated audit log records who did what, to which record, and when, across goals, evidence, work items, meetings, and other partnership activity. Administrator impersonation, used only for support, is itself logged the same way.
We don’t operate our own data centers. Genius OS runs on managed cloud infrastructure: Vercel for application hosting, MongoDB Atlas for our database, Google Cloud Storage for file storage, and Bunny.net for video. Application compute, database, file storage, and video are all provisioned in United States regions. See our Subprocessors page for the full list of providers we rely on and what each one does.
Every response from the application includes standard security headers, including a strict transport security policy and a content security policy scoped to the specific third-party origins the app actually loads.
Every code change runs through automated dependency vulnerability scanning before it can merge, and dependency updates are proposed automatically on a weekly basis. Every pull request and every push to our main branch is also scanned for accidentally committed credentials across the full commit history. Static application security analysis (CodeQL) is configured and runs against the codebase, but its results currently can’t be published without an additional license we haven’t yet purchased; we’re not counting that as “in place” until it genuinely is.
Genius OS is built for district and campus partnership management between UG consultants and district staff. It is not a system of record for individual student-level education records, and student-identifiable data is not a data type the platform is designed to collect or store as part of its core workflow.
UG carries general liability and technology errors-and-omissions insurance. We are also putting in place a combined professional liability, technology services, and cyber policy written by Lloyd’s underwriters, on a claims-made basis. It provides $2,000,000 per claim and in the aggregate for professional liability, and $2,000,000 in the aggregate for cyber and privacy cover, including incident response, legal and forensic costs, system damage and rectification, business interruption, and cyber extortion. Cyber crime cover (funds transfer fraud and similar) is included at lower limits. We’ll update this page with the effective date once the policy is in force.
In the interest of the same plain disclosure as the rest of this page: we do not yet hold TX-RAMP or SOC 2 certification, and we haven’t yet completed a third-party penetration test. We’ve committed to pursuing TX-RAMP certification, and formal incident response, disaster recovery, and business continuity plans are in place internally and being matured over time. If a specific certification or attestation matters to your review, ask us directly and we’ll tell you exactly where things stand.
Security or procurement questions, including requests for a completed vendor questionnaire, can go to ug@untappedgenius.org or our contact page.