Security

Data is encrypted in transit (TLS) and at rest. Sensitive credentials are never stored in plain text.

Staff access is role-based — owners and admins manage the roster and settings; staff can run check-in/out and roll calls. The parent status page is reachable only through an unguessable, per-child link and is never indexed by search engines.

Every safety-relevant action — check-outs, custody overrides, pickup codes, roll calls — is written to an append-only audit log that records who did what and when. The audit trail is a core feature, not an afterthought.

KidTallyruns on US-hosted, reputable cloud infrastructure with managed backups. We isolate each program's data so one program can never see another's.

We do not display certifications we don't hold. We're a new product and are building toward formal attestations over time; we align our practices with childcare recordkeeping needs and will say plainly when a certification is in progress or complete.

Found a security issue? Please email security@kidtally.app and give us a chance to fix it before public disclosure. We appreciate responsible reports.