Litguide Security and Compliance

1. Introduction

Litguide is committed to maintaining the highest standards of data security, privacy, and compliance. Our platform is designed to support school boards, educators, and students while ensuring that all user data is protected through strict security controls and regulatory adherence. This document outlines Litguide’s approach to data protection, infrastructure security, and compliance with applicable privacy laws.

2. Compliance & Data Protection Standards

Litguide only collects essential personal data required for account creation and platform functionality, specifically email addresses and phone numbers. No additional personally identifiable information is gathered.

Litguide adheres to the following data protection laws and privacy frameworks to ensure the security and responsible management of personal information:

• Personal Information Protection and Electronic Documents Act (PIPEDA)
• Personal Health Information Protection Act (PHIPA – Ontario)
• Freedom of Information and Protection of Privacy Act (FIPPA – Ontario)

Litguide ensures that no personal information is made publicly accessible. All data is strictly used for authenticated users within the platform and is not shared externally except as required by law or for platform functionality.

By following these frameworks, we ensure that our data collection, storage, and security practices align with legal obligations and industry standards. Our infrastructure and policies are designed to protect personal information while maintaining transparency and accountability. All personal information collected is used solely for the purpose of providing educational services and platform functionality. Litguide does not sell, distribute, or share personal data with unauthorized third parties.

3. Security Infrastructure

3.1 Secure Hosting & Cloud Infrastructure

Litguide is hosted on Amazon AWS Canada (SOC 2-certified), providing a secure and scalable cloud environment. This ensures data remains protected through: Redundant storage and backup systems to prevent data loss ISO 27001-certified data centers with controlled access DDoS protection and automated security monitoring AWS security features ensure that all data remains confidential and protected from unauthorized access, with continuous monitoring for potential threats.

3.2 Data Encryption & Integrity

To safeguard user data, Litguide employs industry-standard encryption techniques:

Data in Transit: Secured with TLS 1.2 encryption to prevent unauthorized interception

Data at Rest: Stored using AES-256 encryption, ensuring high-level data protection

Authentication Security: OAuth 2.0 and JWT-based authentication are used to protect user sessions

These encryption protocols prevent unauthorized access, ensuring the security of sensitive information.

4. Access Control & Authentication

4.1 User Authentication & Identity Security

To prevent unauthorized access, Litguide employs Google Authentication (Single Sign-On - SSO), allowing users to log in securely. The platform enforces Role-Based Access Control (RBAC), ensuring that users—whether administrators, educators, or students—can only access the features and data appropriate to their role.

Session management policies help protect user accounts by implementing automatic session timeouts and logout procedures after periods of inactivity. These safeguards reduce the risk of unauthorized access in shared environments.

4.2 Administrative & System Access Controls

Administrative access to Litguide systems is restricted to authorized personnel and governed by strict access policies. All access to critical systems is logged, monitored, and reviewed regularly to ensure security. System permissions follow the principle of least privilege, meaning that users only receive the minimum access necessary to perform their responsibilities.

5. Data Retention & Secure Disposal

Litguide follows a structured data retention policy to ensure that personal information is not stored longer than necessary.

• User data is automatically deleted after one (1) year of inactivity
• If a user account is deleted, all associated personal data is securely erased
• Data disposal follows industry best practices, ensuring that no residual information remains recoverable.

These policies help maintain compliance with PIPEDA, PHIPA, and FIPPA while minimizing data exposure risks.

6. Third-Party Security & Integrations

Litguide partners with trusted third-party service providers to enhance security, authentication, and infrastructure reliability. These providers comply with industry-recognized security certifications to ensure the protection of user data.

Litguide's infrastructure is hosted on Amazon AWS Canada, which is SOC 2 and ISO 27001-certified. AWS provides a secure cloud environment that includes encrypted data storage, access-controlled facilities, and real-time security monitoring. This ensures that all collected user data is stored in compliance with Canadian privacy regulations and protected against unauthorized access.

For authentication and communication security, Litguide integrates with Twilio, a SOC 2-certified service that facilitates secure login verification and messaging. Additionally, Google Authentication is used to implement Single Sign-On (SSO), allowing users to securely access their accounts with the highest security standards. Google Authentication complies with ISO 27001 and GDPR requirements, ensuring data protection and account integrity.

Each of these third-party providers follows strict security controls and undergoes regular audits to maintain compliance.

Users can review further details about their security frameworks through their respective documentation:

Amazon AWS Security & Compliance: https://aws.amazon.com/security/

Twilio Security & Compliance: https://www.twilio.com/security

Google Security Overview: https://cloud.google.com/security/overview/

By leveraging these third-party integrations, Litguide ensures secure data storage, encrypted communications, and strong authentication processes, reinforcing its commitment to user security and privacy.

7. Security Monitoring & Incident Response

7.1 Continuous Security Monitoring

Litguide employs active system logging, access monitoring, and security event tracking to detect and prevent security threats. These measures include:

• Intrusion Detection Systems (IDS) and Prevention Systems (IPS) for potential threat detection.
• Real-time system logging and audit trails to monitor unauthorized access attempts.
• Scheduled security audits and compliance assessments to ensure system integrity.

7.2 Incident Response & Breach Mitigation

Litguide follows a structured incident response plan to manage security events effectively. In the event of a security breach, the following steps are taken:

1. Containment of affected systems to prevent further impact.
2. Investigation and forensic analysis to determine the cause and scope.
3. User and regulatory notification, if required.
4. Implementation of corrective measures to prevent recurrence.

8. Security Best Practices for Users

To maintain a secure environment, Litguide enforces security best practices, including:

• Password policies requiring strong credentials.
• Automatic session timeouts to prevent unauthorized access.
• Controlled file uploads to prevent malicious data entry.

Users are encouraged to:

• Keep login credentials confidential.
• Use unique passwords across different platforms.
• Report suspicious activity to the Litguide admin team.

9. Security Inquiries & Contact Information

For security-related questions or incident reporting, users may contact:

Email: privacy@litguide.ca

10. Commitment to Ongoing Security Enhancements

Litguide is dedicated to maintaining a secure platform by implementing best practices for data protection and access control. Security policies and procedures are reviewed and updated as necessary to align with industry standards and regulatory requirements.

Your security is our priority.

Posted: April 18, 2023

Last Updated: April 16, 2023

Effective Date: May 18, 2023