Trust Center

How Lingua protects your school's data, at a glance. For what we collect and how deletion works, see the Privacy Center.

Checking systems…

Last reviewed November 10, 2026

Compliance

Where we stand on each framework

FERPAAligned
COPPAAligned
State student-privacy lawsAligned
Data Privacy AgreementAvailable
SOC 2Not yet
1EdTech TrustEd AppsNot yet
Student Privacy PledgeNot yet
Common Sense PrivacyNot yet

“Not yet” means Lingua doesn't hold it. Our hosting providers (Supabase, Vercel) hold their own SOC 2; we don't claim theirs as ours.

Documents

Sent on request to schools and districts

Found a security issue?

Email it to us. Please report rather than keep testing.

contact@linguaclassroom.com

Security practices

43 practices in place across 6 areas

Data protection

Data encrypted in transit (TLS)
Data encrypted at rest
Data stored in the United States
Student recordings and photos in private storage
Files open only through short-lived links
Permission checked before any file opens
Canvas tokens encrypted (AES-256-GCM)
Card details handled only by Stripe

Access control

Ownership checked on every change
Row-level security on every database table
Roles set by the server, never the browser
Admin tools limited to named Lingua staff
Administrator actions logged
Secrets kept on the server only
Cross-site request checks on billing and admin actions
Rate limits on sign-up and sensitive actions
Known bots and scripts blocked from the app

Responsible AI

Student data never used to train AI
Paid-tier Gemini API only
Only the work being graded is sent
No rosters, student IDs, or gradebooks sent
Every AI grade can be overridden by the teacher
No automated decisions about students
Camera monitoring switched off platform-wide
Secure-testing signals only when a teacher turns them on

Privacy & retention

Student data never sold
No ads or ad trackers
No accounts for children under 13
Student records owned by the school
Account deletion is instant
School deletion requests done within 10 business days
Inactive accounts deleted after 12 months
Trial-class student data deleted 14 days after a trial ends

Reliability

Every service checked live on a public status page
90-day service history published
Incidents posted publicly
Encrypted database backups

Incident response

Written incident response plan
Severity levels and roles defined
Schools notified within 72 hours of a confirmed breach
Written post-mortem within 2 weeks
Plan reviewed every year
Provider incidents passed on to schools