Security Statement

1. Hosting and certifications

• PIPS runs on Base44 (a Wix company), which is SOC 2 Type II and ISO 27001 certified, GDPR compliant and independently penetration-tested, with round-the-clock security monitoring.
• Data is encrypted in transit (HTTPS) and at rest (AES-256).
• Data is stored in the United States. See our Privacy Policy for what that means.

2. Each school's data is kept separate

Every school's records are separated by row-level security rules enforced in the database, not just hidden in the screens. Staff at one school cannot read or change another school's students, classes or records.

3. Roles and permissions

• Teachers award points and update students in their own classes.
• School administrators manage their own school: staff, classes, houses, settings and billing.
• Tech 2 Teach support staff have a separate support role used only to run the service.
• Important actions, such as resets, removing users and billing changes, are checked on our servers, not only in the app.

4. Signing in

Staff sign in with Google, Microsoft or an email and password. Sign-in is handled by our platform's authentication service; Tech 2 Teach never sees your password.

5. Subscriptions and payments

• Payments are processed by Square, whose card-processing systems meet PCI DSS Level 1, the highest payment-security standard.
• Card details are typed into Square's own secure card form. Card numbers never reach PIPS, and PIPS stores only your plan, subscription status and dates.
• Every payment and subscription notice Square sends to PIPS is checked against a cryptographic signature before PIPS acts on it, and PIPS re-checks every subscription with Square daily.
• Plans, renewals, cancellations and refunds are explained in our Terms of Service and Refund Policy.

6. Keys and connected services

• API keys and passwords for connected services are stored as server-side secrets and are never sent to browsers.
• Google Classroom import is read-only and runs only when a teacher chooses to import a class.
• AI Insights sends de-identified data only: no student names, notes, photos or class names.

7. Classroom displays and sign-up forms

• TV and smartboard display links show only the school name, logo and house totals, never student information. Administrators can replace a display link at any time.
• The free-trial sign-up form is protected by Cloudflare Turnstile and rate limits to stop automated abuse.

8. If something goes wrong

We investigate security incidents promptly. If personal information is involved and serious harm is likely, we notify affected schools and the OAIC under the Notifiable Data Breaches scheme.

9. Report a concern

If you think you have found a security problem in PIPS, please email support@tech2teach.com.au. We will acknowledge your report and keep you updated. Please don't access other people's data while testing.

10. On our roadmap

• A Safer Technologies 4 Schools (ST4S) assessment.
• An Australian data-residency option.
• Parent and guardian consent capture.
• School-controlled data export and deletion tools.