Security Overview

Last updated: September 13, 2026

Overview

Center Desk Drawer's security practices are organized around the NIST Cybersecurity Framework (CSF) 2.0's six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. We're an early-stage product, and we'd rather be direct about where we stand today than describe protections we haven't built yet.

Govern

Center Desk Drawer is built and operated by a small team. Security-relevant decisions, like which vendors to use and who can access what, are centralized rather than spread across a large organization. A vendor is only added to our infrastructure if it's necessary to operate the product, with the minimum access its function requires. See Subprocessors for the current list.

Identify

We keep track of what data the platform collects, where it's stored, and who can access it. Data falls into a few categories: account and sign-in information, classroom roster information (a student's first name and last initial), reading activity, family-link tokens, and billing information for paid plans. Each category has a defined access scope, described in Protect below.

Protect

Authentication. Teachers sign in with Google, Microsoft, or email and password. Passwords are hashed by our authentication provider and are never stored in plaintext or viewable by anyone, including us. Unlike some larger platforms, we don't currently check new passwords against a breach database at sign-up. We'd rather say that plainly than imply a protection that isn't there yet.

Access control. Access is enforced at the database layer using PostgreSQL Row Level Security (RLS), not application logic alone. A teacher only ever sees their own classes and the classes explicitly shared with them.

Role-based access. A class has an owner and, optionally, collaborators the owner has explicitly added. Free and paid plan limits, like the 10-student cap on the free plan, are enforced server-side, never left to the client to self-report.

Family-link access. A family link stays active until the teacher revokes it. It isn't automatically time-limited, and using it doesn't require an account, so we can't verify who's actually using a given link. See our COPPA Commitment for more on this trade-off.

Our own team's access. Center Desk Drawer is a small team. If we ever need to access an account for support, we don't yet have a dedicated audit log recording that access the way a larger company might. As we grow, this is an area we intend to formalize.

Encryption. Data is encrypted in transit (HTTPS/TLS) and at rest, consistent with the platform-level defaults of our infrastructure providers (Supabase, Vercel).

Detect

As an early-stage product, we don't operate a dedicated security monitoring or intrusion-detection program beyond what our infrastructure providers (Vercel, Supabase) provide at the platform level. This is an area we expect to invest in as the product and its user base grow.

Respond

If a security incident affects your data, we'll notify you without unreasonable delay after confirming it. If you're using Center Desk Drawer as part of a formal school or district relationship, we'll also cooperate with any notification obligations that relationship requires.

Recover

Our database provider maintains its own infrastructure-level durability and redundancy. We haven't layered a separate, independent backup system on top of it. If disaster recovery specifics matter for your evaluation, ask us and we'll tell you exactly where things stand rather than describe a process in the abstract.

Subprocessors

See our Subprocessors page for the current list of service providers.

Reporting a Security Concern

If you believe you've found a security vulnerability or issue affecting Center Desk Drawer, contact hello@modelb.app. We take all reports seriously and will respond promptly.