Compliance
Security & Breach Notification
Last updated: October 6, 2026
Insight MTSS holds sensitive information about students, so we protect it with reasonable security procedures and practices that meet or exceed industry standards.
How We Protect Student Data
Encryption
Data is encrypted in transit using TLS 1.2+ and at rest. Passwords are hashed and never stored in plain text.
Hosting
Insight MTSS is hosted by GoDaddy in the United States.
Access controls
Role-based permissions limit each staff member to the students and information their role allows. Email and password authentication with secure credential storage.
Limited internal access
Only our personnel who need access to support the service can reach student data, and that access is logged.
Monitoring and logging
We log sign-ins and changes to records and monitor for unusual activity.
Backups
Data is backed up regularly. Backups are encrypted and retained for a defined period through our normal rotation.
Updates
We apply security updates promptly and review our code and systems for vulnerabilities.
Vendors
Every subprocessor that handles student data is contractually required to protect it and use it only to provide services to us.
Training
Our team receives privacy and security training on a regular basis.
Incident response
We maintain a written incident response plan covering SOPPA's 30-day school notice and Illinois PIPA requirements.
Our Breach Notification Commitment
If we determine that a breach has affected student data:
- ✓We will notify the affected school or district as quickly as possible and without unreasonable delay, and no later than 30 calendar days after we determine that a breach occurred, as required by Illinois SOPPA, or sooner if our agreement with the school requires.
- ✓Our notice will describe what happened, the date or estimated date range, the types of student information involved, the number of students affected (if known), and the steps we are taking.
- ✓We will give the school the information it needs to notify parents within its own 30-day deadline and to meet other legal requirements.
- ✓We will cooperate with the school's investigation and with law enforcement.
- ✓We will meet the notice requirements of the Illinois Personal Information Protection Act (815 ILCS 530) and other applicable state breach laws.
- ✓If the breach is our fault, we will cover costs as described in our agreement with the school.
Report a Security Concern
If you believe you have found a security issue or suspect unauthorized access, contact us right away. We take every report seriously and will respond promptly.
Related Pages