Security and Data Protection Plan

1. Governance

Evrica Technologies Inc. ("Provider") maintains a written Information Security Program led by the Chief Executive Officer in the role of Data Protection Officer. The program is reviewed annually, and any material change is documented and made available to LEA customers upon request.

2. Identify

• Asset inventory: All systems processing student data are inventoried in a continuously maintained registry.
• Data classification: Data is classified into Public, Internal, Confidential, and Student-PII tiers. Student PII receives the strictest controls.
• Risk assessment: A formal risk assessment is performed at least annually, and after any material change to systems or threat landscape.
• Subprocessor due diligence: Every subprocessor is evaluated against this Plan before onboarding and reviewed annually.

3. Protect

• Encryption in transit: All connections to Oscar use TLS 1.2 or higher with modern cipher suites.
• Encryption at rest: All student data is encrypted at rest using AES-256 or equivalent. Backups are similarly encrypted; key material is managed in a hardware-backed key-management service.
• Access controls: Access to systems processing student PII is restricted on a least-privilege basis, requires single sign-on with multi-factor authentication, and is reviewed quarterly.
• Application security: Code is reviewed pre-merge. Dependencies are scanned continuously. Vulnerabilities classified High or Critical are remediated within thirty (30) days.
• Endpoint protection: Personnel devices accessing production data require full-disk encryption, endpoint detection, and screen-lock enforcement.
• Personnel security: All personnel with access to student PII complete annual training on FERPA, COPPA, NY Ed Law § 2-d, CA AB 1584 / SOPIPA, and incident response.
• Data minimization: The Provider collects only data necessary for the Services, as described in Exhibit B of the DPA.

4. Detect

• Continuous logging of authentication, authorization, and data-access events.
• Automated anomaly detection on authentication patterns and unusual data-access volumes.
• Security monitoring 24x7 via the Provider's hosting subprocessor's managed services.
• Annual third-party penetration test, with summary report available to LEAs under NDA.

5. Respond

The Provider maintains a written Incident Response Plan aligned to NIST SP 800-61 Rev. 2. In the event of a confirmed or suspected unauthorized disclosure, acquisition, or use of student PII, the Provider will:

1. Initiate containment within one (1) hour of confirmation.
2. Notify each affected LEA without unreasonable delay and no later than seventy-two (72) hours after discovery, in writing, with the information required by Article V of the DPA and applicable state law.
3. Cooperate with the LEA in any further notification to parents, eligible students, NYSED, the California Attorney General, or other authorities as required by law.
4. Provide a post-incident report within thirty (30) days describing root cause, scope, and remediation steps.

6. Recover

• Production data is backed up at least daily, with backups encrypted and retained for thirty (30) days.
• Recovery Time Objective (RTO): four (4) hours for core Services.
• Recovery Point Objective (RPO): twenty-four (24) hours.
• Disaster recovery procedures are tested at least annually.

7. Data Lifecycle

• Collection: Limited to the categories listed in Exhibit B of the DPA.
• Use: Limited to the purposes in Article IV of the DPA.
• Retention: Student data is retained only as long as necessary to deliver the Services, plus any LEA-specified retention period.
• Deletion: Upon LEA request, all student PII is deleted within forty-five (45) days using NIST SP 800-88 Rev. 1 sanitization methods. A written certificate of destruction is provided.
• Storage location: Within the continental United States.

8. Compliance Frameworks

The Provider aligns its program to the following authorities:

• FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99)
• COPPA (15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312)
• CIPA (47 U.S.C. § 254(h))
• PPRA (20 U.S.C. § 1232h)
• CA Education Code § 49073.1 (AB 1584)
• CA Business & Professions Code §§ 22584–22585 (SOPIPA)
• NY Education Law § 2-d and 8 NYCRR Part 121
• NIST Cybersecurity Framework v1.1
• NIST SP 800-53 Rev. 5 (selected moderate-baseline controls)
• NIST SP 800-88 Rev. 1 (media sanitization)
• GDPR-K (where applicable to EU minors)

9. Contact

Security disclosures and incident reports may be sent to security@evrica.ai. Privacy inquiries to privacy@evrica.ai. General school inquiries to schools@evrica.ai.