Security
Security is part of how Goal100 is built.
The short version
- Today Goal100 is a static website over HTTPS with no student database and no passwords.
- When accounts open: proven sign-in provider, encryption, row-level security, two-step sign-in for admins, audit logs.
- We follow the NIST Cybersecurity Framework 2.0, as New York's Part 121 references, and New York's SHIELD Act.
- Found a vulnerability? Tell us privately and give us time to fix it.
This summary helps you read the full text; the full text controls.
1. Today
- Static website served over HTTPS by Netlify; no student database.
- No passwords or student data stored by Goal100.
- Security headers on every page.
- A written information security program, version 1.0 (Nov 10, 2026), summarized on our Security program page. It calls for risk assessments at least once a year (COPPA Rule 16 CFR § 312.8; NY General Business Law § 899-bb).
2. When accounts open
- Sign-in through a proven provider (Supabase); passwords stored only as secure hashes; two-step sign-in for owner and admins.
- Each school sees only its own data (row-level security).
- Encryption in transit and at rest; audit logs; least-privilege access; staff privacy training.
- Practices aligned with the NIST Cybersecurity Framework 2.0, which Part 121 references.
3. If something goes wrong
When accounts open, we will keep a written incident response plan. We notify schools within 7 calendar days of discovering a breach of their student data (8 NYCRR § 121.10), and affected New York residents within 30 days of discovery where General Business Law § 899-aa applies, plus any regulators the law requires.
4. Report a vulnerability
Please tell us through the Contact page (mark it “Security”) and give us reasonable time to fix it before sharing it publicly. Do not access, change or keep anyone else's data, do not disrupt the Service, and do not test against student accounts. We will not pursue legal action against good-faith research that follows these rules. We do not offer payment for reports. Thank you.
Laws and official sources referenced
- NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework (checked Nov 7, 2026)
- Part 121 amendment adopting NIST Cybersecurity Framework 2.0: https://www.counsel.nysed.gov/sites/counsel/files/rulesandregs/terms-part-121.pdf (checked Nov 7, 2026)
- 8 NYCRR § 121.10 (breach notice by contractors within 7 calendar days): https://www.law.cornell.edu/regulations/new-york/8-NYCRR-121.10 (checked Nov 7, 2026)
- NY General Business Law § 899-bb (reasonable data security safeguards): https://www.nysenate.gov/legislation/laws/GBS/899-BB (checked Nov 7, 2026)
- NY General Business Law § 899-aa (breach notification; 30-day outer limit added Dec. 2024): https://www.nysenate.gov/legislation/laws/GBS/899-AA (checked Nov 7, 2026)
- COPPA Rule, 16 CFR Part 312: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 (checked Nov 7, 2026)
Questions about this document: use the Contact page; we answer in writing. We post every change on this page with a new date.