Our information security program
Goal100 keeps a written information security program. This page is its plain summary for schools, BOCES and families.
The short version
- Today we store no student personal information. Progress stays on the student's device.
- Our program is organized by the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, Recover.
- It also covers what New York requires of school contractors (Education Law §2-d and Part 121), including breach notice to a school within 7 calendar days.
- It is new. Some parts start only when accounts open. We say which below.
This summary helps you read the program; a signed agreement with a school controls for that school.
1. Who is responsible (Govern)
- Goal100 Learning is run by ZAKAZIKY LLC, a New York company with one owner. The company's owner is the Security and Privacy Officer.
- Rule one: collect the least data possible. No feature may send student data off the device unless a school has signed a data privacy agreement with us.
- We never give student data, passwords or private files to an outside AI service.
- The program is reviewed every year in November, and after any incident or big change.
2. What we protect (Identify)
| Data | Where it lives | Leaves the device? |
|---|---|---|
| Student progress, nickname, settings | The student's own browser | No. A student may copy a "Send to my teacher" code by hand. |
| A teacher's class list (first names or initials and scores) | The teacher's own browser | No |
| Messages adults send through our forms | Our website host | Only what the adult types and sends |
| Future school accounts | A U.S. database, only under a signed agreement | Not open yet |
We never collect a student's last name, email, birthday, photo, voice, address, ID numbers, or health or IEP information.
3. How we protect it (Protect)
- HTTPS on every page, with strict security headers. The site loads nothing from any other company: no ads, no trackers, no outside scripts or fonts.
- Every code or file a person pastes or opens is treated as untrusted and cleaned before it is shown.
- Owner accounts use two-step sign-in.
- When accounts open: encryption in transit and at rest, each school sees only its own data, least-privilege access, audit logs.
- Anyone who will handle student data is trained on FERPA and New York Education Law §2-d before getting access.
4. How we notice problems (Detect)
- Before each release, automated tests open every page and check for outside requests, security-policy errors and script errors.
- Anyone can report a security problem privately through the Contact page (topic "Security"). See how to report a vulnerability.
5. If something goes wrong (Respond)
We have a written incident response plan: contain, record, assess, notify, fix, learn.
- We notify each affected school within 7 calendar days of discovering a breach of its student, teacher or principal data (8 NYCRR §121.10(a)), and pay for the notices the law requires when the breach is ours (§121.10(f)).
- We cooperate with the school and with law enforcement.
6. Getting back to normal (Recover)
- The website is plain files with a full version history. Our target is to restore it within 24 hours.
- Database backup and restore targets will be set and tested before any school account opens.
7. Honest status (November 10, 2026)
| Function | Status | Next step |
|---|---|---|
| Govern | Written (version 1.0) | Yearly review |
| Identify | In place | Yearly review |
| Protect | In place for today's site | Account safeguards before accounts open |
| Detect | Release tests and a report channel | Logs and alerts when accounts open |
| Respond | Written plan | Yearly practice drill |
| Recover | Website restore plan | Database backups before accounts open |
Not yet: an independent security audit (for example SOC 2 or a penetration test) and cyber insurance. We do not claim them.
School data protection officers can ask for the full program through the Contact page (topic "School or district"). Related: Security · Student Data Privacy · Data privacy agreement template · For BOCES reviewers
Sources
- NIST, "NIST Releases Version 2.0 of Landmark Cybersecurity Framework" (Feb 26, 2024): nist.gov (checked Nov 9, 2026)
- NIST SP 1300, Cybersecurity Framework 2.0: Small Business Quick-Start Guide: csrc.nist.gov/pubs/sp/1300/final (checked Nov 10, 2026)
- 8 NYCRR §121.6, data security and privacy plan: regulations.justia.com (checked Nov 10, 2026)
- 8 NYCRR §121.10, breach notice (7 calendar days; cost of notices): regulations.justia.com (checked Nov 10, 2026)
- NYSED Board of Regents, proposed update of Part 121 to NIST CSF 2.0 (October 2025): regents.nysed.gov (checked Nov 10, 2026)
General information, not legal advice. We post every change on this page with a new date.