Security

At Open Parachute, the protection of student and educator data is central to our mission. We implement a multi-layered security approach across every part of our platform — from infrastructure and authentication to monitoring, backup, and vendor oversight. This ensures the confidentiality, integrity, and availability of our services.

Product Security

Authentication & Access Control

• All platform access is protected with strong passwords and Two-Factor Authentication (2FA).
• Super-admins authenticate via Google Authenticator; school administrators use secure email-based 2FA.
• We support SAML-based Single Sign-On (SSO) and use JWT tokens for authenticated sessions.
• Session timeouts and lockout after failed attempts protect against brute-force attacks.

Authorization & Role-Based Controls

• Access to features and data is role-restricted and enforced server-side.
• User roles are isolated both vertically (across permission levels) and horizontally (between accounts).

Secure Password Policies

• Passwords must meet complexity requirements and are hashed using SHA-256 with salting.
• Initial passwords are sent securely and accounts contain no confidential data on first login.

Infrastructure Security

Cloud Hosting

Our platform is hosted entirely in Amazon Web Services (AWS), leveraging their robust physical security and compliance standards. Infrastructure is deployed across multiple availability zones for high availability and fault tolerance.

Virtual Private Cloud (VPC) & Firewall Rules

All servers operate within our own VPC with tightly scoped network access control lists (ACLs) and security groups. Internal firewall restrictions limit lateral movement and enforce least-privilege access.

Secure Developer Access

Production services are not publicly exposed. Developers access dev environments through certificate-based VPNs to EC2 instances, with traffic encrypted end-to-end.

Change Management

All infrastructure changes are managed through Terraform and GitOps. Code changes require peer review, are tracked in Git, and are automatically deployed through a secure CI/CD pipeline. Monitoring systems detect and roll back failed deployments.

Content Delivery Security

We deliver all static and downloadable content via a secured CDN, never through public S3 links. This allows us to enforce bot protection, firewall rules, and secure access at the edge.

Application & Data Security

Encryption

• TLS is enforced across all endpoints. HSTS is enabled and our site scores "A+" on SSL Labs.
• Data at rest, including user identifiers and assessments, is encrypted using SHA-256 and other secure methods.
• Passwords are never stored in plain text and are hashed and salted securely.

Security Headers & Protections

• We use headers such as CSP, Referrer-Policy, and X-Frame-Options to protect against XSS and clickjacking.

Our app scores "A" on SecurityHeaders.com.

Input Sanitization & Secure Development

• We use templating systems that automatically escape user input.
• ORM frameworks (e.g. Sequelize) with prepared statements prevent SQL injection.
• CSRF tokens, secure cookies, and DOM-based XSS protections are in place.

Vulnerability Management

Automated Scanning

• We use automated security scanning tools to continuously monitor our infrastructure for changes or activities that could pose a security risk. Any alerts or findings are promptly reviewed and triaged by our security team to ensure timely investigation and response.

Testing Practices

• All deployments are staged and tested using dummy data.
• Security tests are part of our unit and release testing.
• In-house security reviews include code review, black-box testing, and red-teaming.

Penetration Testing

• We regularly test our systems using independent tools that simulate real-world attacks to uncover and fix potential vulnerabilities. This ensures our platform stays secure and our users' data remains protected as we continue to grow and evolve.

Patching

• Operating systems, containers, runtimes, and libraries are updated regularly to the latest supported versions.

Monitoring & Incident Response

Threat Detection

• We maintain real-time logging, alerting, and monitoring to detect and investigate suspicious activity.
• Engineers trained in security assess incidents and initiate mitigation procedures.

Incident Reporting

If you believe you've identified a security vulnerability, please contact us:

[email protected]

Device & IT Security

Endpoint Management

• All employee laptops are centrally managed with enforced encryption, anti-malware protection, and patch automation.
• Root/admin access is restricted and external media use is blocked.

Logging & Access Control

• Security-relevant events are logged across all client devices.
• Access is limited to the minimum required per role and revoked immediately when staff offboard.

Secret Management

• Sensitive data (e.g. API keys, QR codes, credentials) are never shared through email, Slack, or public storage tools.
• We use secure, dedicated tooling to store and transfer secrets.

Backups & Business Continuity

Redundant, Encrypted Backups

• Production databases are backed up daily and encrypted at rest.
• Company-wide backups are stored off-site weekly.
• AWS-native services handle automated backup retention and secure deletion.

Disaster Recovery

• We follow AWS best practices for fault tolerance and multi-zone availability.
• Our platform is built to maintain functionality in the event of data center failure.

Compliance & Governance

Governance & Oversight

• We are aligned with ISO 27001 standards and are actively working toward certification.
• Security policies cover all areas including infrastructure, HR, vendors, and change management.
• Internal audits occur annually, and third-party reviews validate controls.

Vendor Management

• We require all vendors to contractually agree to strong data protection measures. Many are ISO 27001 or SOC 2 certified.

Data Residency

• User data is stored in-region (Australia, USA, or Canada) to meet privacy requirements.

Cyber Insurance

• We maintain $1 million USD in cyber liability insurance as part of our risk mitigation strategy.

Privacy Policy

• View our Privacy Policy

Contact Us

For questions or to report a security concern:

[email protected]