This page describes the safeguards Checkmark has in place today. We update it when they change. If your school or district needs more detail for a review, contact us and we will answer your questions directly.
How we use school data
- Schools own the student work they submit to Checkmark.
- Our agreements with schools designate Checkmark as a school official under FERPA.
- We do not sell student data or use it for advertising.
How we handle personal information is described in our Privacy Policy.
Encryption
- Connections to the Checkmark website and app use HTTPS, with TLS 1.2 and TLS 1.3 supported.
- Database backups are encrypted before they leave our servers.
Network protection
- Traffic to Checkmark is routed through Cloudflare, which provides a web application firewall and protection against denial-of-service attacks. Our application servers accept web traffic only from Cloudflare.
- Internal administration tools sit behind an additional sign-in, and the connections between our own services require authentication tokens.
- Server administration uses SSH keys only; password logins to our servers are disabled.
Backups
- The application database is backed up every night. Each backup is encrypted and copied to a separate storage provider, where backups are kept for 30 days.
- Submissions and reports are archived to that provider every hour, and our backup storage uses 30-day object locks to protect against accidental or malicious deletion.
Accounts and access
- Teachers, students, school administrators and district administrators have separate roles. Each role sees only the classes, students and reports it is permitted to see.
- People can sign in with Google, Microsoft, Clever or ClassLink.
- Signed-in sessions expire after two hours of inactivity, and repeated failed sign-in attempts lock the account for a period of time.
Security reviews
In October 2026 we completed an internal security review of the Checkmark app and its LMS and sign-in integrations. Critical findings were fixed and deployed, and we continue to work through the remaining items.
Incident notification
If a security incident affects your institution's data, we will notify you promptly in writing and work with you on next steps.
Reviews and questionnaires
We complete school and district security and privacy questionnaires, including HECVAT, on request. Our accessibility conformance report (VPAT) is also available on request.
Report a security issue
If you believe you have found a security issue, or you need security documentation, email us with the details and we will follow up with you directly.