Security at SchoolMorph

Student data stays in Australia

Student photos, names, and parent email addresses are stored in Sydney, Australia, in the AWS ap-southeast-2 region, through our database and storage provider Supabase. The service that generates the morph videos runs in the same Sydney region on Fly.io.

For Australian schools, there is no cross-border transfer of student imagery or student records. Transactional email and (in future) payment processing involve overseas sub-processors, but those services never receive student photos or facial data, only the information needed to send an email or process a payment. The full list is below.

Access is locked down by default

• Private storage only. Student photos are never served from a public URL. Every photo displayed in the browser is loaded through a short-lived signed URL that expires within minutes.
• Row-level security.The database and storage buckets enforce ownership at the row level. A teacher can only see their own project. A parent can only see their own child's upload page, via the private link emailed to them.
• Server-side download gate. Final video downloads are gated server-side on payment or approved beta access. There is no client-side flag that can be flipped to bypass this.
• No open admin surface. There is no admin dashboard exposed to anyone except the founder. The administrative credential that can bypass row-level security is held in a secrets manager and used only when investigating a specific technical issue a coordinator has reported.

Photos are deleted automatically

Student photos and generated video files are automatically deleted 30 days after the ceremony, by a scheduled cleanup job. Deleting a project also deletes its photos and database rows together, in a single cascade. A coordinator can delete a project manually before the 30-day window if they want the data gone sooner.

What we deliberately do not do

• No biometric identification. We analyse photos only to align the two images for morphing. No facial templates are stored, nothing is cross-matched against other photos, and nothing is used to identify any individual.
• No AI training on your data. Student photos are never used to train, tune, or evaluate any machine learning model.
• No marketing use of student photos. We do not use student photos in demos, case studies, website copy, or social media without separate written consent.
• No sale of data. We do not sell, rent, or share student or parent data with third parties. The product has no business model that depends on it.
• No cross-site tracking. We do not use advertising cookies or trackers that follow users around the web after they leave the site.

Infrastructure built on certified providers

SchoolMorph itself is a small Australian operator; we do not claim our own certifications. Our data infrastructure is operated by Supabase, which maintains SOC 2 Type II and ISO 27001 certifications and operates under a GDPR-aligned data processing agreement. Hosting and worker infrastructure (Vercel, Fly.io) operate under equivalent third-party-audited security programs.

Sub-processors

See our full sub-processor list for the complete breakdown of every vendor that touches any part of a project, what they see, and where they operate.

For procurement and privacy teams

A short-form Data Processing Agreement is available on request and is designed to be signed in one to two pages, not negotiated over months. We also respond to vendor security questionnaires within 20 business days.

Email schoolmorphing@gmail.com to request a DPA, a signable sub-processor list, responses to a vendor security questionnaire, or early deletion of a specific project.

Reporting a security concern

If you believe you have found a security issue affecting SchoolMorph, please email schoolmorphing@gmail.com with the subject line "Security". We acknowledge reports within one business day.