Security
Chirpo handles student work, so we design it to collect little, keep it locked to the right people, and tell schools quickly if something goes wrong. This page explains how, and how to report a security problem to us. Our privacy policy explains what information Chirpo collects and why.
How Chirpo is protected
Access to student work
- People sign in with their school's Google account. Chirpo has no passwords of its own to steal.
- Each time someone opens or changes an activity, Chirpo checks with Google Classroom that they are a teacher or student in that exact class. The answer is reused for at most 30 minutes before Chirpo asks again.
- Students can see only their own conversations, and only see results after their teacher releases them. Teachers can see only their own classes.
- Chirpo asks Google for the smallest set of permissions that lets it work in Classroom. It can't read email, Drive files or class rosters.
Data
- Chirpo stores no names or email addresses, so there are fewer details to lose.
- All connections use HTTPS, and Google Cloud encrypts stored data.
- Google's sign-in tokens stay on our servers. The browser holds only a random session ID, in a cookie that scripts on the page can't read.
- Voice recordings are turned into text and discarded, never stored.
- Downloaded results use one-time links that expire after one minute.
The service
- Chirpo runs on Google Cloud in Toronto. Each part of the service has its own account with only the permissions it needs, and keys are kept in Google Secret Manager, not in our code.
- Chirpo's pages can be embedded only by Google Classroom, and requests that change data are accepted only from Chirpo itself, to block attacks from other websites.
- Features we use for development and testing are switched off in the live service.
- Automated tests check who can see and change each activity, and run before every release.
- Only InterThread staff who need it can access the production systems.
If something goes wrong
If we learn that personal information may have been accessed, lost or disclosed without permission, we will:
- act right away to contain the problem;
- notify the affected schools as quickly as possible, telling them what happened, what information was involved and what we are doing about it;
- report to the Office of the Privacy Commissioner of Canada, and to any other authority, where the law requires it;
- work with schools to notify students and families where needed; and
- fix the cause, and keep a record of the incident.
Report a vulnerability
If you think you have found a security problem in Chirpo or this website, please email interthreadsoftware@gmail.com with “Security report” in the subject. Tell us what you found, how to reproduce it, and what someone could do with it.
We will acknowledge your report within 5 business days, keep you updated, and let you know when it's fixed. We don't currently offer payment for reports, but we're happy to thank you publicly if you'd like.
Please
- Test only with accounts you own or have permission to use. Never use a real student's account.
- Stop as soon as you reach information that isn't yours, don't keep or share it, and tell us what you saw.
- Don't overload the service, send spam, or try to trick our staff or schools' staff.
- Give us a reasonable time to fix the problem, normally 90 days, before telling anyone else about it.
If you act in good faith and follow these guidelines, we won't take legal action against you for your research, and we'll treat your work as helpful.
To report a safety concern about something Chirpo said to a student, see our safety page instead.
Contact
InterThread Software
28 Rynard St.
Sunderland, ON, Canada
interthreadsoftware@gmail.com