Data & Access

What this is

A description of how your data is handled, so you can judge whether it is good enough for your school. This is not something you buy; it comes with everything else.

What is in place

• Accounts and passwords, with roles that limit what each account can open.
• Data held on infrastructure we rent from Cloudflare. Traffic is over HTTPS.
• A log of sign-ins and of changes made inside the workspace.
• Export of your data as CSV or files, on request, at any time.
• Deletion of your data on request, confirmed when it is done.
• Retention settings you choose per area, so old records can be removed on a schedule.

What is not in place

• No certifications. No SOC 2, no ISO 27001, no PCI-DSS attestation of our own, no COPPA or FERPA compliance certification, no safeguarding accreditation. BackPR has never been audited.
• No compliance guarantee. We can tell you what the software does. Whether that makes your school compliant with FERPA, COPPA, GDPR or anything else is a judgement for your own counsel or DPO.
• No security team. No 24/7 monitoring, no incident response rota, no penetration testing programme, no bug bounty.
• No SSO or SAML. Sign-in is email and password.
• No insurance, no service credits, no uptime guarantee. There is no liability cover behind this and no compensation scheme if something goes wrong.
• No assurance packs, no quarterly audit reports, no DPIAs written for you.
• No breach-response service. If there were a breach we would tell you what we know as soon as we know it. Notifying regulators and families would be your school’s job.

Where a school should be careful

BackPR is new and has no operational track record. Keep your own copy of anything that matters, as you would with any supplier; everything you put in can be exported at any time. If your district requires a supplier with ISO 27001 or SOC 2, BackPR does not qualify.

Questions and answers

Who at BackPR can see our data? Technically, BackPR can, because we administer the servers. In practice we do not read your content, and we will tell you if we ever need to open something to fix a fault.

Where is data stored? On Cloudflare infrastructure. Ask us and we will tell you the exact region in use.

Can we sign a data processing agreement? Yes, a reasonable one. We would rather work from your template than draft our own.

Can we get everything out and leave? Yes. Export, then ask us to delete. We will confirm when it is done.

Do you sell or share data? No. There is no advertising and no third-party analytics beyond what is needed to run the product.

Who runs it? BackPR, from Messina, Italy. Write to support@backpr.com.

Related

• Whisper · Message Intake
• Support