The data is about children. We build like it.
The people signing in are parents and staff. What is inside is a record of somebody's child — where they were, who collected them, what a teacher wrote down. That difference drives most of the decisions below.
Each school is its own island
Every record is scoped to a school at the database layer. No school on the platform can reach another's families, staff, billing, or photos — the isolation is structural, not a permission checkbox someone could get wrong.
Sensitive fields are encrypted where they sit
Addresses, phone numbers, dates of birth, and medical and custody notes are encrypted before they are written. A stolen database file yields ciphertext for those fields, not a spreadsheet of children's details.
Photos are private by default
Stored off the application server in private buckets, with random file names, reached only through short-lived links issued after a permission check — and every issued link is logged.
Location data is stripped on upload
A phone photo taken at pickup can carry the exact coordinates of your building. We remove that metadata server-side before the image is ever stored.
Payment details never reach us
Cards and bank accounts are tokenized by Stripe. The numbers do not touch our database for tuition or for our own billing, which keeps the blast radius of any breach far smaller.
Staff accounts carry real protection
Two-factor authentication is required for staff on the web interface, sign-in attempts are rate limited, and a login from an unfamiliar address emails the account holder.
Access follows the role, not the org chart
- Teachers see their own classrooms. Not the school, and never another location.
- Parents see the rooms their own child is in, and their own family's billing.
- School admins run their school and nothing beyond it.
- Pickup authorization lives on the child, separately from who holds an account — because in custody situations those are genuinely different lists.
- Verification detail stays internal. Parents see the event; the address and distance behind it are for audits and disputes.
On compliance, honestly
Childcare software sits under several regimes at once: COPPA, FERPA where federal funding is involved, state student-privacy laws, state breach-notification laws, and your own state's licensing rules. We are building against all of them and will sign a data-privacy agreement with each school individually.
What we will not do is print a row of compliance badges and imply a certification we do not hold. If you need specific contractual language for your state, ask and we will work through it with you.
Questions we get asked
Can another school on Firstep see our families?
No. Every record carries the school it belongs to, and every query is scoped by it at the database layer rather than filtered in the interface. Tenant isolation is the foundation the platform is built on, not a setting.
Where are classroom photos stored?
In private object storage, separate from the application server. Nothing is publicly readable. When a parent opens a photo, the application checks that they have a child in that room and then issues a short-lived link that expires quickly. Every issued link is logged.
Do you store card or bank account numbers?
Never, for either tuition payments or our own billing. Stripe tokenizes both cards and bank accounts, so the numbers never reach our database in any form.
What happens to our data if we leave?
It is yours. Data export on account closure is on the roadmap, and in the meantime we will produce your records on request. We do not hold data hostage as a retention tactic.
Do you use our data to train anything, or sell it?
No. Your families' data is used to run your school's account and nothing else. No advertising, no resale, no profiling of students.