Security & Data

1. Who is responsible for the data

The institution is always the data controller. Incidenta, a product of Baind LLC, is its processor: we handle reports, case files and directory information only on the institution's instructions and only to provide the service. We never use institutional data for our own purposes and never sell or share it. In the United States we act as a “school official” under FERPA where applicable; in Colombia as the “encargado del tratamiento” under Ley 1581 de 2012. We sign a data-processing agreement with every institution.

2. Where the data lives

Application data and uploaded evidence are stored on Convex, a managed database and file-storage platform, in the United States. The application is hosted on Vercel and identity is handled by WorkOS, both in the United States. Each institution's data is logically isolated: every record belongs to one organization and every query checks that the person asking belongs to it. Where cross-border transfer rules apply, we rely on safeguards such as standard contractual clauses or the institution's authorization.

3. Encryption

• In transit: every connection to the website and the application uses TLS.
• At rest: the database and file storage encrypt data at rest, managed by the infrastructure provider.
• Sessions: sign-in sessions live in secure, http-only cookies that page scripts cannot read.

4. Who can see what

Access is role-based and enforced on the server, not in the interface. Each institution manages its own directory and assigns roles that follow the principle of least privilege: most people can only file reports and follow their own; case content is visible only to the staff assigned to handle it and to the institution's designated leadership; and administering the directory does not by itself grant access to case files. Roles can be changed or revoked by the institution at any time.

Anonymous reports are visible only to the people authorized to take them, never to the reporter's own view. Staff sign in with their institutional Google Workspace or Microsoft 365 account, so access ends when the institution disables the account.

5. Traceability

Every action on a case is recorded with who did it and when: status changes, assignments, evidence, notes, conclusions. Closed case files are archived rather than deleted, so the institution always has a record it can produce for an audit, a regulator or a family.

6. Subprocessors

The providers that handle institutional or personal data on our behalf. This list matches the Privacy Policy.

7. Questions we are usually asked

Do you hold a security certification?

Not yet. We are a small team in private beta and would rather say so than imply otherwise. Our infrastructure providers hold their own certifications, which we can point you to. Incidenta is designed to support institutions' obligations under FERPA and COPPA in the United States and Ley 1581 in Colombia.

How long do you keep our data, and can we take it with us?

For as long as the institution uses the service and a reasonable period afterwards, then deleted or returned under the agreement. Case files may be kept longer where the institution's legal or safeguarding obligations require it; that is the institution's decision. Directory and case data can be exported in Excel or CSV at any time, and full deletion can be requested when the relationship ends.

What happens if there is a data breach?

We notify the affected institution without undue delay, with what we know, what we are doing and what we recommend. The institution decides, with our support, on notifications to families and authorities under FERPA, applicable U.S. state student-privacy laws or Colombia's Ley 1581.

How do you build and ship changes?

We follow a defined software development life cycle: every change is reviewed and passes automated checks before it can ship, third-party dependencies are monitored for known vulnerabilities, changes are tested in a separate environment before production, and production releases are controlled and versioned.

How do I report a vulnerability?

Write to contacto@incidenta.co with the details. We welcome good-faith reports, read every one, and will tell you when the issue is fixed.

8. Documents on request

The data-processing agreement, the subprocessor list as a document, and answers to your security questionnaire are available on request at contacto@incidenta.co or on the call you book with us.