Security & Trust

Security your district can stand behind.

Nexus connects your most sensitive data, so protecting it is not a feature, it's the foundation. Here is exactly how we keep student and staff information safe.

FERPA & COPPA aligned TLS 1.2+ in transit AES-256 at rest Ed-Fi API Consumer

How we protect your data

Secured at every layer.

Encryption, access control, and network security work together so the right people see the right data, and no one else.

Encryption, in transit and at rest

Every connection uses TLS 1.2 or higher. Data at rest is protected with Transparent Data Encryption in Azure SQL and AES-256 encryption for file storage.

Azure Key Vault manages credentials and API keys, with rotation and audit logging
Firewalls block unauthorized access to storage and databases

Access control & SSO

Multi-factor authentication and role-based access ensure people only see the data their role requires.

SSO with Google Workspace and Microsoft Azure Active Directory
Every access to sensitive data is logged and regularly audited

Network security

Layered network defenses are designed to keep traffic contained and monitored.

Azure Firewall and a Web Application Firewall (WAF) at the HTTP layer
Network Security Groups, VNet peering, and VPN Gateway for encrypted connections

Your data stays yours

We never sell your data. Full stop.

Nexus works for your district and no one else. Personal information is only collected when explicitly provided or authorized, and you control it from there.

✓

Never soldCourseflow, Inc. strictly prohibits the sale of personal information or data.

✓

Shared only when necessaryOnly with service providers under strict privacy agreements, or when required by law.

✓

Yours to access, correct, or deleteRequest changes to your personal information at any time.

✓

Retained only as long as neededData is securely removed at your direction, in line with retention policy.

Compliance & standards

Ready for your privacy officer.

Hand this to the people who vet your vendors. Our practices are built around the standards districts are held to.

FERPA

Family Educational Rights and Privacy Act

Nexus acts as a school official under FERPA, accessing education records only to perform the services your district authorizes.

COPPA

Children's Online Privacy Protection Act

Additional safeguards are in place for users under the age of 13.

Ed-Fi

Ed-Fi Data Standard v4.0 · ODS / API Suite 3

Nexus is a registered Ed-Fi API Consumer, so your data moves cleanly between systems.

ISO/SOC

Aligned with ISO 27001 and SOC 2

Our security program is designed and operated in alignment with these frameworks, structured around the requirements they define and maintained through ongoing internal review.

If something goes wrong

Monitored, backed up, and ready to respond.

Continuous monitoring

Advanced monitoring tools continuously watch for anomalies and potential security incidents, with alerting to our response team.

A defined response plan

Our incident response team follows a documented plan to contain and mitigate any impact.

Automated backups

Automated backups run continuously with point-in-time restore, replicated across Azure infrastructure for recoverability.

Have security questions?

Bring your toughest privacy and security questions. Our team will walk your district through every answer.

Talk to our team

Questions about our privacy practices? Reach us at support@asknexus.ai