Security at Teacher Hive
Teacher Hive is built so that apps teachers make never need to know who a student is. Here is how the platform protects the data it does hold.
Students stay anonymous
- Students never create accounts or sign in. They open an app with a link.
- Teacher Hive never asks students for names, email addresses, student ID numbers, or location, and its Terms forbid any app from asking. Before publishing an app that saves students' work to Teacher Hive, a teacher confirms the app follows this rule.
- Some apps save work only in the student's own browser. That stays on the device and never reaches Teacher Hive.
- Every app's code is scanned daily for personal information and private keys, and every outside web address an app loads is checked against Google's list of unsafe sites.
- Apps added since October 14, 2026 each run on their own subdomain (such as your-app.apphive.us), so one app can never read what another app saved in a browser.
Where data is kept
- Account and app data is stored in the United States on Google Cloud, encrypted at rest.
- The database is backed up daily (kept 90 days) and can be restored to any point in the last 7 days.
- Teachers can delete their account and data at any time from My Settings.
A written security program
Teacher Hive follows the CIS Critical Security Controls v8, Implementation Group 1, the baseline the Center for Internet Security recommends for small organizations. The program is reviewed every October as a yearly security assessment, and after any incident. The most recent assessment was an internal audit in October 2026.
- Administrator access is limited to one account, which signs in only through Google with 2-Step Verification.
- Server secrets are kept in Google Secret Manager, and the site runs without stored key files.
- Every code change is tested and tried on a private copy of the site before it goes live.
If something goes wrong
Teacher Hive keeps a written incident response plan. If personal data is ever exposed, Teacher Hive stops the problem first, works out what data and whose, and then notifies:
- affected teachers by email within 24 hours of discovery;
- any school or district with a data privacy agreement within 72 hours, with the details that agreement requires, and helps the district notify families.
For schools and districts
Full copies of the security program and the incident response plan are available to schools and districts on request. The Privacy Policy lists the service providers that handle data.
To request them, or to report a security problem, email tony@teacherhive.app.
