Introduction
Enrollio is built specifically for childcare centers and preschools, helping you streamline enrollment, manage families, and grow your business. Since our launch, we've focused on one thing: making your life easier while keeping your data secure.
We measure our success by your success. That's why security and compliance aren't just checkboxes for us — they're core to everything we do.
Our Security Commitment
Your families trust you with their children. You trust us with your data. We take that responsibility seriously.
Enrollio has invested in comprehensive security programs across our platform, infrastructure, and organization. Our Legal Team works with every department to ensure these programs are implemented and maintained to the highest standards.
Our Security Objectives
We've built our security framework using industry best practices. Here's what we're committed to:
- Customer Trust and Protection: Deliver reliable service while protecting the privacy and confidentiality of your families' data
- Availability and Continuity: Keep Enrollio available when you need it and minimize any service disruptions
- Data Integrity: Ensure your enrollment data, parent information, and records are never corrupted or altered inappropriately
- Compliance with Standards: Meet or exceed industry security and compliance standards
Security Controls
To protect the data you entrust to us, Enrollio uses multiple layers of administrative, technical, and physical security controls. Here's how we keep your information safe.
Infrastructure Security
Cloud Hosting
Enrollio doesn't host data in physical offices. Instead, we partner with industry-leading cloud providers: Google Cloud Platform and Amazon Web Services (AWS).
Our infrastructure is hosted in the United States and relies on Google's and AWS's audited security and compliance programs for physical, environmental, and infrastructure protection.
Reliability: Google provides at least 99.5% uptime. AWS guarantees between 99.95% and 100% service reliability with full redundancy for power, network, and HVAC services.
Both providers maintain SOC 2 Type 2 certification and ISO 27001 compliance. You can review their compliance documentation on their public compliance pages.
Network Security
The Enrollio platform enforces multiple layers of filtering and inspection on all connections. We use logical firewalls and security groups to control access.
Network-level access controls prevent unauthorized access to our internal infrastructure. By default, firewalls deny any connection that isn't explicitly authorized.
We review firewall rules regularly to ensure only necessary connections are configured. All changes go through our standard change control process.
Configuration Management
Our infrastructure is highly automated and scales with your needs. All server configurations are embedded in images and configuration files that deploy automatically when new capacity is needed.
Each server container uses its own hardened configuration. Changes to configurations go through a controlled change pipeline.
We tightly control servers from provisioning to deprovisioning. If a production server deviates from the baseline configuration, it's automatically overwritten within 30 minutes.
Patch management uses automated tools or removes non-compliant server instances entirely.
[SCREENSHOT: Diagram showing Enrollio's layered security infrastructure with cloud providers, firewalls, and configuration management]Logging
Every action and event in Enrollio is comprehensively logged. These logs are indexed and stored in a central logging solution in our cloud environment.
Security-relevant logs are retained separately to help with investigation and response activities. Retention periods depend on the type of data logged.
Write access to log storage is tightly controlled and limited to a small subset of engineers who require it.
Monitoring and Alerts
Enrollio uses automated monitoring and alerting to continuously address potential issues. Our infrastructure triggers alerts when anomalies occur — including error rates, suspicious activity, or application attacks.
These alerts go directly to the appropriate engineering teams for immediate response.
Application Security
Web Application Protection
Enrollio implements multiple security layers to protect against common web application attacks:
- Protection against SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities
- Input validation on all user-submitted data
- Output encoding to prevent malicious code execution
- Rate limiting to prevent abuse and denial-of-service attacks
Development and Release Management
Security is built into our development process from day one. Our engineering team follows secure coding practices and conducts code reviews before any release.
All code changes go through automated security testing as part of our continuous integration pipeline. We use static code analysis tools to identify potential vulnerabilities before code reaches production.
Vulnerability Management
We actively monitor for security vulnerabilities in our platform and dependencies. Our security team:
- Conducts regular vulnerability scans
- Reviews security advisories for third-party components
- Prioritizes and patches critical vulnerabilities immediately
- Works with external security researchers through responsible disclosure
Data Protection
Data Classification
We classify data based on sensitivity:
- Sensitive Personal Information: Parent contact details, child information, medical records, payment information
- Business Data: Enrollment records, tour schedules, staff information
- System Data: Configuration settings, user preferences, activity logs
Each classification has appropriate security controls applied based on sensitivity level.
Account Separation
Each childcare center's data is logically separated in our system. Your families' information is never accessible to other Enrollio customers.
We enforce strict access controls at the database and application level to maintain this separation.
Encryption
Data in Transit: All data transmitted to and from Enrollio is encrypted using TLS 1.2 or higher. This includes data sent between your browser and our servers, as well as internal communication between our systems.
Data at Rest: All sensitive data stored in Enrollio databases is encrypted using AES-256 encryption. This includes parent information, child records, and payment details.
Key Management
Encryption keys are managed using industry-standard key management services provided by our cloud hosting partners. Keys are:
- Automatically rotated on a regular schedule
- Stored separately from encrypted data
- Protected with strict access controls
- Never stored in plaintext
Backup and Disaster Recovery
Backup Strategy
Enrollio maintains comprehensive backups to ensure your data is never lost. Our backup strategy includes:
- Automated daily backups of all customer data
- Real-time replication to multiple geographic regions
- Point-in-time recovery capabilities
- Regular backup restoration testing
System Backups
We back up all critical systems daily. Database snapshots are taken continuously and stored in secure, geographically distributed locations.
Application configuration and infrastructure definitions are version-controlled and can be redeployed rapidly if needed.
Physical Backup Storage
Backups are stored in multiple AWS and Google Cloud regions for redundancy. These facilities provide:
- Physical security controls including access restrictions and surveillance
- Environmental controls for temperature and humidity
- Fire suppression systems
- Redundant power and network connectivity
Backup Protection
All backups are encrypted using the same standards as production data. Access to backups is strictly controlled and logged.
We regularly test backup restoration procedures to ensure we can recover quickly in any scenario.
Customer Data Restoration
If you accidentally delete data, contact our support team. Depending on the type of data and timing, we may be able to restore from backups.
We retain backups for 90 days, giving you ample time to identify and recover accidentally deleted information.
Identity and Access Control
User Management
You control who has access to your Enrollio account. You can:
- Add and remove staff members
- Assign role-based permissions (Admin, Staff, Limited Access)
- Require multi-factor authentication for your team
- Review audit logs of user activity
Login Protections
Enrollio includes multiple protections for account logins:
- Strong Password Requirements: Minimum length and complexity requirements
- Multi-Factor Authentication (MFA): Optional two-factor authentication using authenticator apps or SMS
- Account Lockout: Automatic lockout after multiple failed login attempts
- Session Management: Automatic logout after inactivity
- Login Notifications: Email alerts for new device logins
Enrollio Employee Access
Customer Data Access: Enrollio employees do not have routine access to your data. Access is granted only when:
- You request support and give explicit permission
- Critical security or infrastructure issues require immediate attention
- Legal requirements mandate access
All employee access to customer data is logged and monitored. Access is granted through time-limited, audited sessions.
Production Infrastructure Access
Access to production systems is restricted to a small number of senior engineers. All access requires:
- Multi-factor authentication
- Approved justification and business need
- Comprehensive logging
- Regular review and recertification
Corporate Authentication
Enrollio employees use single sign-on (SSO) with multi-factor authentication for all corporate systems. Employee accounts are:
- Provisioned through a centralized identity management system
- Reviewed regularly for appropriate access levels
- Immediately deprovisioned when employees leave the company
Organizational Security
Background Checks and Onboarding
All Enrollio employees undergo background checks appropriate to their role and location before starting work. New hires complete security awareness training during onboarding.
Policy Management
We maintain comprehensive security policies covering:
- Acceptable use of company systems
- Data handling and classification
- Incident response procedures
- Vendor management
- Physical security
Policies are reviewed and updated annually or when significant changes occur.
Security Awareness Training
All Enrollio employees complete annual security awareness training covering:
- Recognizing phishing and social engineering attacks
- Handling sensitive data appropriately
- Reporting security incidents
- Password and authentication best practices
Vendor Management
We carefully vet all third-party vendors who may have access to customer data or our infrastructure. Our vendor management process includes:
- Security questionnaires and due diligence reviews
- Contractual security and confidentiality requirements
- Regular reviews of vendor security posture
- Monitoring of vendor security incidents
Endpoint Protection
All Enrollio employee devices include:
- Encrypted hard drives
- Up-to-date antivirus and anti-malware software
- Automatic security updates
- Remote wipe capabilities
- Endpoint detection and response tools
Compliance and Privacy
Sensitive Data Processing
Enrollio processes sensitive personal information including:
- Parent and guardian contact information
- Child information and records
- Payment and billing data
- Medical information (if you choose to store it)
We handle this data in accordance with applicable privacy laws and regulations, including GDPR, CCPA, and COPPA.
Privacy Program
Our privacy program ensures we:
- Process personal data only for specified, legitimate purposes
- Collect only the data necessary to provide our service
- Maintain accuracy of personal information
- Retain data only as long as necessary
- Protect personal data with appropriate security measures
Data Retention and Deletion
We retain your data for as long as you maintain an active Enrollio account. When you close your account:
- Your data is scheduled for deletion within 90 days
- Backups containing your data are purged according to our retention schedule
- You can request immediate data deletion by contacting support
We may retain certain data longer when required by law or for legitimate business purposes (such as billing records).
Data Subject Rights
Parents and families whose information is stored in Enrollio have rights under various privacy laws. As a data controller, you're responsible for responding to these requests. Enrollio provides tools to help you:
- Export personal data
- Update or correct information
- Delete records
- Restrict processing
Breach Response
In the unlikely event of a data breach, Enrollio has a comprehensive incident response plan:
- Detection: Automated monitoring and alerting systems detect potential security incidents
- Containment: Immediate action to stop unauthorized access and prevent further damage
- Investigation: Thorough analysis to understand scope and impact
- Notification: Timely notification to affected customers and regulatory authorities as required by law
- Remediation: Steps to prevent similar incidents in the future
If a breach affects your account, we'll contact you immediately with details about what happened and what steps we're taking.
GDPR Compliance
For customers who serve families in the European Union, Enrollio provides:
- Data Processing Agreements (DPAs) available on request
- Standard Contractual Clauses for international data transfers
- Tools to support data subject access requests
- Documentation of our security measures
Questions About Security?
We're always happy to discuss our security practices in more detail. Contact our support team or reach out to security@enrollio.com for:
- Security questionnaires
- Additional compliance documentation
- Data Processing Agreements
- Specific security questions
Last Updated: This security overview is reviewed and updated regularly to reflect our current practices and any significant changes to our security posture.