Security Plan

This Data Security and Privacy Plan ("Plan") describes the administrative, operational, and technical safeguards that Cues Technologies Inc. (trading as GradingPal) has in place to protect personally identifiable information (PII), including Student Data, in connection with the provision of educational technology services to schools and educational agencies. This Plan is provided in satisfaction of the requirements of New York Education Law § 2-d and 8 NYCRR Part 121, and is aligned with the NIST Cybersecurity Framework Version 1.1.

1. Implementation of Data Security and Privacy Contract Requirements

GradingPal implements data security and privacy contract requirements through the following program:

Governance and Accountability

• A designated privacy contact (Rajesh Vora, rajesh@gradingpal.com) is responsible for data privacy and security compliance across all school contracts.
• All school and district contracts include a Data Processing Addendum (DPA) and Student Data Privacy Addendum (SDPA) that bind GradingPal to the privacy obligations of FERPA, COPPA, SOPIPA, NY Education Law § 2-d, and applicable state privacy laws.
• This Plan and all associated data security policies are reviewed and updated at least annually and whenever material changes are made to the Service.

Contract Lifecycle

• Prior to the commencement of any school contract, GradingPal confirms that data protection agreements are in place and that applicable safeguards described in this Plan are active.
• Data security and privacy requirements are incorporated into the Master Service Agreement, DPA, and SDPA executed with each Educational Agency (EA).
• GradingPal will notify the EA of any material changes to data practices, sub-processors, or security measures that affect Student Data, with at least 30 days' notice where practicable.
• Upon termination of a contract, GradingPal follows the data return and destruction process described in Sections 6 and 7 of this Plan.

2. Administrative, Operational, and Technical Safeguards

Administrative Safeguards

• A designated privacy contact is responsible for overseeing data protection practices, responding to data rights requests, and managing compliance obligations.
• All employees and contractors who access PII or Student Data are required to complete privacy and security training prior to receiving access and annually thereafter.
• Access to Student Data is granted on a need-to-know basis only and is reviewed regularly to ensure least-privilege access controls are maintained.
• GradingPal maintains a sub-processor list at www.gradingpal.com/sub-processors and requires all sub-processors that process Student Data to comply with data protection standards consistent with applicable law.
• A written incident response plan is maintained and reviewed annually. See Section 5 for details.

Operational Safeguards

• Employee access to production systems containing Student Data is protected by multi-factor authentication (MFA) and role-based access controls.
• GradingPal performs regular reviews of access permissions and revokes access promptly upon employee or contractor offboarding.
• System changes and deployments follow a documented change management process to prevent unintended exposure of Student Data.
• Automated backup procedures are in place for all systems containing Student Data. Backups are tested on a regular basis to verify recoverability.
• Vendor and sub-processor relationships are reviewed prior to onboarding to confirm adequate data protection terms and security certifications are in place.

Technical Safeguards

• All Student Data is encrypted at rest using AES-256 encryption.
• All data transmitted between users and GradingPal's systems is encrypted in transit using TLS 1.2 or higher.
• GradingPal's infrastructure is hosted on Google Cloud Platform, Render.com, Supabase and Vercel — all of which maintain SOC 2 Type II compliance and encryption standards consistent with industry best practices.
• API keys, credentials, and secrets are stored in environment variables only and are never committed to source code repositories.
• Application error monitoring and log management are in place to detect anomalies and support incident investigation.
• Security patches and software updates are applied promptly upon availability.

3. Employee and Subcontractor Training

GradingPal provides training to all employees and contractors who access or handle Student Data or PII prior to granting access and on an annual basis thereafter. Training covers:

• The requirements of FERPA, COPPA, SOPIPA, NY Education Law § 2-d, and other applicable federal and state student privacy laws;
• GradingPal's internal data privacy and security policies and procedures;
• Permissible and prohibited uses of Student Data, including prohibitions on targeted advertising, profiling, and re-identification of de-identified data;
• Social engineering and phishing awareness;
• Incident identification and reporting procedures; and
• Data handling, storage, and destruction requirements.

Training completion is documented for each employee and contractor. Access to Student Data is not granted until training is completed. All sub-processors who access Student Data are required to maintain equivalent training programs for their own personnel under the terms of their data processing agreements with GradingPal.

4. Contracting Processes for Employees and Subprocessors

GradingPal ensures that all employees and sub-processors handling Student Data are bound by written agreements that meet or exceed the data protection requirements of applicable school contracts.

Employees and Contractors

• All GradingPal employees and contractors who access Student Data are required to sign a confidentiality agreement as a condition of employment or engagement.
• Employment and contractor agreements include explicit provisions prohibiting the use of Student Data for any purpose outside of the provision of the Service.
• Access is promptly revoked upon termination of employment or engagement.

Sub-processors

• GradingPal maintains a current list of sub-processors at www.gradingpal.com/sub-processors and updates it prior to engaging any new sub-processor that will process Student Data.
• All sub-processors that access or process Student Data are engaged under written data processing agreements that: (i) prohibit use of Student Data for any purpose other than providing services to GradingPal; (ii) prohibit disclosure of Student Data to subsequent third parties without authorization; (iii) require implementation of reasonable security practices; and (iv) require compliance with applicable data protection laws.
• GradingPal's AI service providers (including Anthropic PBC, OpenAI OpCo LLC, Google LLC, Microsoft Corporation, and Mistral AI SAS) are explicitly prohibited by contract from using Student Data to train AI models.

5. Data Security and Privacy Incident Management

Incident Detection

• Application error monitoring and log management (Vercel, Mixpanel & Axiom) are in place to detect anomalous activity and potential security incidents in real time.
• All GradingPal employees are trained to identify and immediately report suspected security incidents or unauthorized disclosures of Student Data to the designated privacy contact.

Incident Response

• GradingPal maintains a written incident response plan that is reviewed annually and updated as necessary.
• Upon identification of a suspected incident involving Student Data, GradingPal will: (i) promptly investigate to confirm the nature and scope of the incident; (ii) take immediate steps to contain the incident and prevent further unauthorized access; (iii) preserve evidence for investigation; and (iv) notify affected EAs within 72 hours of confirmation of the incident, or sooner if required by applicable law.

Breach Notification

• Breach notification to the EA will include, at a minimum: the date or estimated date of the breach; the nature of the incident; the types of Student Data involved; the estimated number of records affected; steps taken to contain the breach; and the name and contact information of GradingPal's privacy contact.
• GradingPal will cooperate fully with the EA, the New York State Education Department Chief Privacy Officer, and law enforcement in any investigation of a breach attributable to GradingPal or its sub-processors.
• Notification obligations comply with NY Education Law § 2-d, FERPA, and all applicable state breach notification laws.

6. Data Transition and Return

Upon written request from the EA, or upon termination or expiration of the applicable Service Agreement, GradingPal will provide the EA with a complete export of all Student Data in a commonly used, machine-readable format (such as CSV or JSON) within the timeframe specified in the applicable DPA.

Where Student Data is stored in file formats such as PDFs or images, GradingPal will provide access to those files via a secure download mechanism. GradingPal will work with the EA to agree on a reasonable schedule and format for data transfer that meets the EA's operational needs.

Data transition and return processes are performed securely, using encrypted transfer mechanisms where technically practicable. GradingPal will confirm in writing once all requested data has been transferred.

7. Secure Destruction of Data

Following the return of Student Data to the EA (or, where no return is requested, following the expiration of the applicable retention period), GradingPal will securely destroy all copies of Student Data in its possession and in the possession of its sub-processors, including from all backup systems, in accordance with NIST SP 800-88 guidelines for media sanitization.

Secure destruction includes: deletion and overwriting of database records; removal of files from storage systems including cloud object storage (AWS S3); and confirmation of destruction from sub-processors that held copies of the Student Data.

GradingPal will provide the EA with written certification of destruction within a reasonable time following completion of the destruction process. Certification will confirm: the date destruction was completed; the categories of Student Data destroyed; and the destruction method employed.

8. Alignment with EA Data Security and Privacy Policies

GradingPal's data security and privacy program is designed to align with and support the data security and privacy policies of the Educational Agencies it serves. Specifically:

• GradingPal's contractual terms (DPA and SDPA) are designed to meet or exceed the requirements of EA data security policies, including the NYSED Parents Bill of Rights for Data Security and Privacy.
• GradingPal will review and comply with EA-specific data security and privacy policies provided to it upon execution of a service agreement.
• GradingPal will cooperate with EA audits of its security and privacy measures upon written request, subject to reasonable notice and confidentiality protections.
• GradingPal will provide the EA's Chief Privacy Officer or designee with copies of its privacy and security policies upon request.
• GradingPal will notify the EA of any material changes to its data practices, sub-processor list, or security program that may affect compliance with the EA's policies.

9. NIST Cybersecurity Framework v1.1 Alignment

The following table describes how GradingPal's data security and privacy program aligns with each category of the NIST Cybersecurity Framework Version 1.1 (NIST CSF v1.1), as required by the New York State Education Department.