Security Policy

Last Updated: July 22, 2026•Version 1.0

KidProsper Security Policy

Version: 1.0

Effective Date: July 21, 2026

Last Updated: July 21, 2026

Status: APPROVED FOR LEGAL REVIEW

Owner: KidProsper Compliance Engine (KCE)

Welcome to the KidProsper Security Policy. Protecting the confidentiality, integrity, and availability of the information entrusted to us by parents—especially sensitive developmental and behavioral data regarding children—is a foundational operational pillar at KidProsper.

This policy outlines the technical, administrative, and physical safeguards implemented across the KidProsper platform, infrastructure, and backend services (including KIE, KRE, KPE, and KCE).

1. Security-by-Design Principles

KidProsper operates on a strict Privacy-by-Design and Security-by-Design philosophy. Security controls are integrated into every layer of our architecture rather than treated as an afterthought.

  • Data Minimization: We collect only the information strictly necessary to power the KidProsper developmental framework.

  • Isolation of Sensitive Data: Child profiles, assessment scores, and AI conversation logs are segregated from public-facing or marketing services via strict network segmentation.

2. Child Data Classification Framework

To enforce appropriate technical and administrative safeguards, KidProsper classifies information into four distinct tiers based on sensitivity:

Data Classification

Examples

Security Controls

Restricted

Child Profiles, Assessment Responses, Growth Blueprints, KP Scores, AI Coach Chats

Encrypted at rest (AES-256) and in transit (TLS 1.3); strict RBAC; isolated cloud storage.

Confidential

KCE Consent Logs, Parent Account Details, Billing & Subscription Records

Encrypted databases; multi-factor authentication required for administrative viewing.

Internal

Operational Metrics, System Diagnostics, App Performance Logs

Restricted to internal engineering personnel via secure VPNs.

Public

Marketing Materials, KP Blog Content, Public Legal Policies

Standard public web distribution.

3. Encryption Standards

We protect data both while it is moving across networks and while it is stored at rest:

  • Encryption in Transit: All traffic between the KidProsper mobile application/website and our NestJS backend API is encrypted using industry-standard Transport Layer Security (TLS 1.3). HTTP-to-HTTPS redirection is strictly enforced.

  • Encryption at Rest: All databases, cloud storage buckets, and cached assets containing user or child profiles are encrypted using strong cryptographic standards (AES-256).

  • Key Management: Cryptographic keys are managed via secure cloud key management services with strict rotation policies and restricted access.

4. Access Controls and Authentication

Access to production systems and sensitive family data is governed by the principle of least privilege:

  • Secure Authentication: Parent accounts utilize robust third-party authentication providers (Google Sign-In, Apple Sign-In), eliminating password-related vulnerabilities on our servers.

  • Role-Based Access Control (RBAC): Internal employee and administrative access to production systems is strictly restricted based on job function, enforced via RBAC and multi-factor authentication (MFA).

  • No Unauthenticated Access: All API endpoints processing child or account data require valid, cryptographically signed JSON Web Tokens (JWT) verified by the backend.

5. Infrastructure Security and Cloud Architecture

KidProsper is hosted on enterprise-grade cloud infrastructure providers.

  • Network Segmentation: Production databases, application servers, and staging environments are isolated within secure virtual private clouds (VPCs) with strict firewall rules and security groups.

  • Continuous Monitoring: We deploy automated intrusion detection, application performance monitoring, and real-time security alerting to identify and respond to anomalies rapidly.

  • Disaster Recovery & Backups: Encrypted disaster recovery backups are executed automatically on a rolling schedule to ensure business continuity without compromising user data purge schedules.

  • Availability & Uptime: While KidProsper implements robust business continuity and disaster recovery measures, we do not guarantee uninterrupted availability of the Services, protecting the platform against third-party cloud outages, DNS failures, or AI provider interruptions.

6. Audit Logging and Governance via KCE

The KidProsper Compliance Engine (KCE) maintains comprehensive, immutable audit trails across the platform.

  • Lifecycle Tracking: KCE records critical security and data lifecycle events (such as account sign-ins, consent acceptances, data exports, soft deletes, and hard purges).

  • Audit Trail Protection: Audit logs are write-protected and retained for up to seven (7) years specifically for legal defense, compliance verification, and security forensics.

7. Vulnerability Management and Testing

To ensure proactive defense against emerging threats:

  • Dependency Scanning: Automated CI/CD pipelines scan open-source libraries and backend dependencies for known vulnerabilities before deployment.

  • Penetration Testing: KidProsper schedules periodic third-party penetration testing and security audits of our API endpoints and mobile application codebases.

8. AI Security and Model Safeguards

Because artificial intelligence is central to the KidProsper Coach:

  • No Public Training: User interactions and child data are strictly isolated and are never used to train public or third-party foundational AI models.

  • Prompt Safety Filters: All inputs to and outputs from the AI model pass through automated safety guardrails managed by KIE to prevent data leakage, prompt injection attacks, or inappropriate content generation.

9. Incident Response and Breach Notification

In the unlikely event of a security incident or data breach affecting personal information:

  • Rapid Containment: Our incident response team will immediately act to isolate affected systems and mitigate risks.

  • Regulatory & User Notification: KidProsper will notify affected users and relevant supervisory authorities in accordance with statutory timelines and legal mandates.

10. Security Certifications and Periodic Review

  • Future Framework Alignment: KidProsper periodically evaluates industry-recognized security frameworks, including ISO 27001, SOC 2, and other applicable standards, as part of its ongoing security maturity roadmap.

  • Periodic Review Cadence: KidProsper conducts periodic reviews of its security controls, infrastructure, and policies to maintain alignment with evolving threats, regulatory shifts, and industry best practices.

11. Employee Security Awareness

All KidProsper personnel, contractors, and developers undergo mandatory security and privacy awareness training upon onboarding and participate in ongoing education regarding secure coding practices and child data protection.

12. Responsible Disclosure Program

KidProsper values the security community. If you are a security researcher or parent who has discovered a vulnerability in our systems, we encourage you to responsibly disclose it to us.

  • Security Contact: security@kidprosper.com

  • Guidelines: Researchers must act in good faith, avoid service disruption, avoid accessing unrelated data beyond proof-of-concept, and provide reasonable time for our engineering team to remediate vulnerabilities before public disclosure.

  • Commitment: We pledge not to initiate legal action against researchers who report vulnerabilities in good faith and adhere to these responsible disclosure guidelines.