Compliance & Security
CherryChat is built for schools and clinical providers serving nonverbal individuals. CherryChat's compliance program documents our controls for FERPA, COPPA and data protection. CherryChat is designed to support schools' FERPA and COPPA obligations. Schools remain responsible for their own compliance. We will sign a school's standard data privacy agreement on request.
FERPA Compliance
- CherryChat is designed to support schools' FERPA obligations. School and vendor agreements must be confirmed before a school uses regulated student data.
- Student educational records (messages, sessions, boards) are treated as "school official" records under FERPA.
- Access to student data is restricted to authorized school staff (teachers, co-teachers, TAs, specialists) who have a legitimate educational interest.
- All staff data access is audit-logged via the AuditLog entity, recording who accessed what data and when.
- Parents/guardians can request access to their child's educational records through the guardian portal.
- Schools control data retention periods via the `data_retention_days` setting (default: 365 days).
- Data is never sold to third parties or used for advertising.
COPPA Compliance
- CherryChat is designed to support schools' and families' COPPA obligations for students under 13. See Students under 13.
- Students under 13: When a school sets up CherryChat for its students, the teacher records that the school consents on parents' behalf for school use. A guardian gives consent separately for home access and for family and friends chat. Guardians can change or withdraw their consent at any time from their Dashboard. A student without recorded consent can't log in.
- Student data is never used for AI model training.
- Guardians can request deletion of their child's data at any time; schools can cascade-delete all student data.
- Direct identifiers (name, DOB, email) are stored only in the Student entity with role-based access controls.
Security Practices
- All data access is enforced server-side via backend functions with explicit authorization checks.
- Row-Level Security (RLS) prevents cross-classroom and cross-user data access at the database level.
- Student authentication uses HMAC-signed session tokens with 12-hour TTL and mid-session revocation capability.
- Rate limiting prevents brute-force attacks on login, join, and claim endpoints.
- All failed authentication and authorization events are logged as security events in the audit trail.
- Clinical credentials are admin-verified before billing access is granted.
- SOAP notes maintain immutable version history for clinical record integrity.
- Error messages are standardized to prevent information leakage and enumeration attacks.
Data Retention & Deletion
- Messages, canvas events, and modeling events are automatically purged after the classroom's retention period (default: 365 days).
- Code-based chat rooms expire automatically after 24 hours.
- Deleted students trigger a cascade deletion of all related records (messages, sessions, boards, contacts, consent records, SOAP notes).
- Deleted classrooms cascade-delete all students, sessions, boards, and related records.
- Audit log entries are anonymized (not deleted) when a student is deleted, preserving the audit trail without PII.
- Guardians can request data deletion through the guardian portal or by contacting their school.
Incident Response
- Automated security monitoring runs every 30 minutes, detecting brute-force patterns, failed security events, and mass data exports.
- Admins receive email alerts when suspicious patterns exceed thresholds (10+ failed events/hour, 5+ exports/hour, 15+ rate-limit hits).
- Compromised student accounts can be immediately revoked via token invalidation.
- Compromised staff accounts can be removed from all classroom staff arrays, terminating access on the next request.
- Compromised guardian accounts can have all relationships revoked, denying access to student data.
- Stolen home codes can be rotated, invalidating all previously issued codes.
- All incident response actions are audit-logged for post-incident review.
- Schools should contact their CherryChat admin immediately upon suspecting a data breach.
Data Processing & Vendors
- CherryChat is hosted on the Base44 platform (Wix infrastructure, Google Cloud Platform).
- AI processing uses OpenAI, Anthropic, and Google Gemini models via the Base44 integration layer.
- Student and guardian names are removed before student records are sent to AI.
- All data is stored in the United States (GCP us-central1 region).
- Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Base44 manages infrastructure security, backups, and disaster recovery.
- Schools should contact Base44 support for specific DPA, BAA, or vendor security questionnaire requirements.
AI Features
| Feature | What is sent |
|---|---|
| SOAP note drafts (credential-verified SLPs only) | Session message labels and goals, with student and guardian names removed |
| Practice coaching | Goals, history and message labels, with names removed |
| Progress summaries | Message logs, with names removed |
| AI board builder | A board structure request, including grid size, category names and board vocabulary |
| PDF or PNG board upload | Only the uploaded board file |
| Literacy Library reading buddy | The student's own message and the book title |
| Book symbol suggestions | Board symbol labels, to match a book's words |
| Lesson and book content tools | No student records |
Student and guardian names are removed before student records are sent to AI.
CherryChat uses AI providers (OpenAI, Anthropic and Google) for the features listed above. Student and guardian names are removed before student records are sent. We are confirming with our platform provider that these providers do not keep prompts or use them to train models. We will update this page when that is confirmed.
HIPAA
- CherryChat is working toward offering a business associate agreement (BAA) for clinicians. Contact us to ask about availability. CherryChat does not claim HIPAA compliance.
Questions or Requests
Schools and guardians can request data access, deletion, or clarification by contacting their CherryChat administrator. For vendor-level security documentation, DPA requests, or BAA agreements, please contact Base44 support.
Questions? Send a message from the Help page. Please don't include private student information in general support messages.