Security & Compliance
Last reviewed October 13, 2026
Regulatory framework
SEMFAS is built with FERPA and New York Education Law § 2-d in mind. Whether they apply to a given school depends on that school's own funding and status, which is a question for its legal counsel. This page describes technical safeguards, not a legal determination.
Data protection
Data is encrypted in transit (TLS 1.2 or higher) and at rest by our hosting and database providers.
Access controls
Access is role-based, with permissions assigned to each person individually. Passwords are stored only as one-way hashes. Signing in also requires a one-time code sent to the user's email. Sign-ins, record changes, and views of the most sensitive records are logged.
Monitoring
An independent uptime monitor checks the site every 5 minutes and alerts the administrator right away if it goes down. Errors are reported automatically to an error-tracking service set up to exclude student names, contact details, and clinical content.
Independent review
SEMFAS has had an independent third-party security review.
Questions
For questions about data handling, contact your administrator.