Security

Who runs TeachPassport

TeachPassport is operated by Buddy Labs LLC. These pages and the register are governed by the laws of the State of Georgia.

Hosting and infrastructure

The application runs on Vercel, hosted in the United States. The database, authentication and private file storage run on Supabase, also hosted in the United States.

Encryption

Data is encrypted in transit with HTTPS and at rest in the database and file storage.

Account access

TeachPassport for Schools sends a passwordless sign-in link to each administrator's own confirmed email address. Organization roles and school or site permissions still limit what each administrator can see and change. Administrators should protect their email accounts with the security options offered by their email provider.

Evidence storage

An optional screenshot of an official lookup result is uploaded to private quarantine storage, scanned by a contracted malware-scanning service, and moved to private, access-controlled storage only after a clean result. A file that fails the scan is removed. Downloads use short-lived signed links.

Data retention

After the paid period ends, the register becomes read-only and the organization can export its data at any time. Covered records are kept, not deleted, unless the organization owner separately asks for deletion from Settings; that request deactivates the organization immediately, and the organization's data is deleted 30 days later unless a legal hold applies.

Subprocessors

TeachPassport uses a small number of contracted providers, each limited to the information needed for its function:

• Vercel – application hosting
• Vercel Analytics – aggregate, privacy-safe product usage analytics
• Supabase – database, authentication and file storage
• Backblaze B2 – encrypted recovery copies in US East
• Stripe – payment processing
• Resend – transactional email delivery
• Cloudmersive – malware scanning of uploaded evidence files

Report a problem

Email hello@teachpassport.com or use the support inbox to report a security problem or ask a question. We reply by email within one business day.