Where we stand on SOC 2
Planning Period has not completed a SOC 2 audit and we do not claim a SOC 2 report, certification, or attestation. What we do publish is our readiness posture: the controls below are organized around the SOC 2 Trust Services Criteria (security, availability, confidentiality, processing integrity, and privacy) so that a district review or a future audit has something concrete to evaluate.
If your district needs a completed report or a signed data agreement before staff may use the platform, contact us first and we will walk through your review process.
Security (access control)
We keep the number of people and systems that can reach data as small as possible.
- Administrative access is limited to the people who operate the platform, granted by role rather than shared logins.
- Access is reviewed when someone's role changes and removed when they leave.
- Members reach only their own account and their own generated materials.
- Production secrets and API keys are stored in managed secret storage and never committed to the codebase.
Encryption and data protection
Traffic between your browser and our services is encrypted in transit over HTTPS. Data held by our hosting and database providers is encrypted at rest by those providers. Payment card details are handled by our payment processor's flow rather than stored in our own application database.
Confidentiality of your content
Your lesson inputs and generated plans belong to you. We do not sell them, we do not use them for advertising, and we do not share them with other members. AI processing is used only to generate what you asked for. As described in our privacy notice, we ask users to keep student-identifying information out of the platform entirely, which is the strongest confidentiality control available.
Availability and change management
Availability is handled through managed infrastructure and a controlled release process.
- The application runs on managed cloud hosting with provider-level redundancy and backups.
- Changes are reviewed before release and can be rolled back if a release causes problems.
- Dependencies are kept current and scanned for known vulnerabilities.
Monitoring and incident response
We monitor application errors and unusual activity, and we investigate anything that suggests unauthorized access. If we determine that customer data was affected by a security incident, we will notify affected account holders and, where a school is involved, work with the school so it can meet its own notification obligations. We do not guarantee that incidents cannot happen; we commit to handling them transparently.
Vendor management
We use a short list of service providers for hosting, database, AI model processing, and payments. Before adding a provider we review what data it would receive, whether that access is necessary, and its published security posture. Providers receive only what they need to perform their function.
Report a vulnerability
If you believe you have found a security issue, email security@planningperiod.app with enough detail to reproduce it. Please give us a reasonable window to investigate and fix before public disclosure, and avoid accessing other users' data while testing. We will confirm receipt and keep you updated on the fix.
Questions from districts
Send security questionnaires, data-privacy agreements, or architecture questions to security@planningperiod.app and tell us your district and timeline. We answer questionnaires directly rather than pointing you at a badge.
See also our privacy and FERPA practices.