← Schools · Districts · Security · Vendor packet
Security questionnaire answers
Answers to questions district technology and data privacy officers often ask. Every answer comes from our published Security, Student Data Privacy and DPA template pages. Where those pages do not answer a question yet, we say so.
Two stages. Today, Goal100 is a static website with no student accounts and no student data. When accounts open, they open only for a school or district that has signed a data privacy agreement. Answers marked “when accounts open” describe published commitments for that stage. The signed agreement controls. General information, not legal advice.
Where you see Not published yet, the answer will be added to this page before school accounts open. Other questions: the support form (topic: Security); we answer by email, in writing.
1. Company and service
| Question | Answer |
|---|
| Who is the vendor? | ZAKAZIKY LLC, a New York limited liability company doing business as Goal100 Learning (DPA template §1). |
| What does the service do? | Lessons, practice, progress and mastery reports, and support for the school's students and staff (Student Data Privacy §6, exclusive purposes). |
| Business address and phone | Not published yet |
| Named security or privacy officer | Not published yet |
| Cyber liability insurance | Not published yet |
2. Data collected
| Question | Answer |
|---|
| What student data is collected today? | None. No student personally identifiable information is collected. Progress is stored on the device; progress codes are shared only by the student (Student Data Privacy §1). |
| What will be collected when accounts open? | The minimum: nickname, class, scores and settings. No student email, birthday, last name, photo or voice (DPA template §4). |
| Ads, tracking cookies or analytics? | No ads, no tracking cookies, no analytics (FAQ). Student data is never sold or used for marketing (Student Data Privacy §4). |
| Is student data used to train AI? | No. Never (Student Data Privacy §4; DPA template §4). |
| Who owns the data? | The district, and students and parents as the law provides (DPA template §3). |
3. Hosting, location and sub-processors
| Question | Answer |
|---|
| Hosting provider | Today: a static website served over HTTPS by Netlify; no student database (Security §1). |
| Database and sign-in (when accounts open) | Sign-in through Supabase; passwords stored only as secure hashes (Security §2). |
| Sub-processors | Hosting and database providers only (for example Netlify and Supabase), bound in writing to the same data protection duties; a list is provided to the school (Student Data Privacy §6). Notice to the district before adding a sub-processor that receives protected data (DPA template §6). |
| Where is data stored? | In the United States only (Student Data Privacy §4, §6; DPA template §5). |
| Specific data-center regions | Not published yet |
4. Encryption and access control
| Question | Answer |
|---|
| Encryption in transit | HTTPS/TLS (Student Data Privacy §6). Today every page is served over HTTPS (Security §1). |
| Encryption at rest | When accounts open: encryption at rest by the database provider (Student Data Privacy §6; Security §2). |
| Encryption algorithms and key management details | Not published yet |
| How is one school kept apart from another? | Row-level security, so each school sees only its own data (Security §2; Student Data Privacy §6). |
| Admin sign-in | Two-step sign-in for owner and admins (Security §2). |
| Least privilege and audit logs | Least-privilege access and audit logs (Security §2; Student Data Privacy §6). |
| Staff training | People with access are trained on the laws that protect student data before receiving access (Student Data Privacy §4; DPA template §5). |
| Staff background checks | Not published yet |
| Single sign-on / rostering (Google, Clever, ClassLink) | Not offered. Today there are no student accounts, so there is nothing to sign in to. No single sign-on or rostering integration is promised. |
| Security headers | Security headers on every page (Security §1). |
5. Frameworks and program
| Question | Answer |
|---|
| Security framework | Practices aligned with the NIST Cybersecurity Framework 2.0, which Part 121 references; New York's SHIELD Act (Security). |
| Written information security program | Yes: a written information security program, version 1.0 (Nov 10, 2026), summarized on the Security program page. A yearly written risk assessment is not done yet. |
| Independent audit (for example SOC 2) or penetration test | Not published yet The DPA says we will share summaries of independent assessments on reasonable request (DPA template §10). |
| Data security and privacy plan (8 NYCRR § 121.6) | Attached as Exhibit C of the agreement; contents listed in DPA template §12. The full plan text will be posted in the vendor packet before school accounts open. |
| Accessibility (WCAG 2.1 AA) | Designed to WCAG 2.1 AA; no independent audit yet, so no claim of full conformance (Accessibility). |
6. Incidents and breach notice
| Question | Answer |
|---|
| Breach notice to the school | In the most expedient way possible and no more than 7 calendar days after discovery (8 NYCRR § 121.10) (Security §3; DPA template §7). |
| Notice to New York residents | Within 30 days of discovery where General Business Law § 899-aa applies, plus any regulators the law requires (Security §3). |
| Who pays for notifications? | Goal100 pays for or reimburses the full cost of required notifications when the breach is attributed to Goal100 (DPA template §7). |
| Incident response plan | When accounts open, a written incident response plan (Security §3). |
| Vulnerability reports | Through the Contact page, marked “Security”. Good-faith research under the published rules is welcome; no payment for reports (Security §4). |
| Backups, recovery time and recovery point | Not published yet |
7. Return and deletion
| Question | Answer |
|---|
| At the end of the contract | At the district's choice: return in a common format (such as CSV) or transfer to a successor, then secure deletion (DPA template §9). |
| Deletion timeline | Within 60 days, with backups expiring within a further 35 days (DPA template §9). |
| Written proof | Deletion is certified in writing (DPA template §9). See the sample certificate in the Vendor packet. |
| De-identified data | May be kept only if it cannot reasonably identify any person, only to improve the service and never for marketing (DPA template §9). |
Sources
Rules can change. If a link and this page ever disagree, the official page or the signed agreement wins.