[ Data Security and Privacy Plan ]

Prepared in alignment with the NIST Cybersecurity Framework v1.1 and the New York State Education Department Model Data Security and Privacy Plan.

1. Implementation of Data Security and Privacy Requirements

Juniper Consulting LLC provides educational technology products under the trade name Juniper Reading CoLab. Juniper Reading CoLab’s products — Navigate (diagnostic screener), Decode (structured phonics intervention), and Close Read (guided close reading) — serve teachers and students in grades 3–12.

This Data Security and Privacy Plan describes how Juniper Reading CoLab implements and maintains the data security and privacy requirements of its contracts with Local Education Agencies, including the National Data Privacy Agreement executed through the Student Data Privacy Consortium.

The founder and sole operator of Juniper Consulting LLC maintains direct oversight of all data processing, security operations, and privacy compliance throughout the life of each contract. There are no employees with access to student data other than the founder. This direct-control model means there is no delegation chain for privacy compliance decisions — every policy described in this plan is implemented and monitored by the same individual who signs the DPA.

This DSPP is reviewed and updated at minimum annually, and whenever a material change occurs in Juniper Reading CoLab’s products, infrastructure, or subprocessor relationships.

2. Administrative, Operational, and Technical Safeguards

2.1 Data Minimization

Juniper Reading CoLab’s primary safeguard is aggressive data minimization. Student records contain only a first name (or initials, at the teacher’s discretion). We do not collect student last names, email addresses, phone numbers, home addresses, dates of birth, student ID numbers, Social Security numbers, or any other personally identifiable information beyond first names. Students do not create accounts. Students access Juniper products through system-generated access codes provided by their teacher.

2.2 Technical Safeguards

All application data is stored in the United States, hosted on Supabase infrastructure in US-East (North Virginia). Supabase maintains SOC 2 Type II compliance.

Encryption.

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Database connections require SSL.

Access control.

Row-Level Security is enabled on all 89 tables in the public schema. Client-facing tables enforce role-based access policies: teachers can access only their own students’ data, school administrators can access data within their organization, and district administrators can access data across schools within their district. Tables that are accessed only by server-side functions operate under a deny-all policy (RLS enabled, no client-facing policies), ensuring that any future client-side access fails closed rather than open. No teacher can view, query, or export another teacher’s student records.

Authentication.

Teachers authenticate via email and password with optional Google SSO. Sessions use secure, HTTP-only cookies scoped to the .juniperreadingcolab.com domain. Student access uses a dual-field validation system (first name + access code) with rate limiting to prevent brute-force attempts. Access codes are 7-character unambiguous alphanumeric strings with database-enforced uniqueness.

Credential management.

All service credentials (database connection strings, API keys, webhook secrets) are stored as encrypted environment variables in Vercel’s deployment infrastructure. No secrets appear in application source code. All source code repositories are private.

Security headers.

Student-facing applications deploy a comprehensive security header set including Content-Security-Policy (restricting script, style, connect, media, and image sources to known origins), X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy (strict-origin-when-cross-origin), and Permissions-Policy (disabling camera, microphone, and geolocation). Security header deployment is being standardized across all application surfaces.

2.3 Administrative Safeguards

The founder maintains direct familiarity with FERPA (34 CFR Part 99), COPPA (16 CFR Part 312), New York Education Law § 2-d and 8 NYCRR Part 121, and the applicable student data privacy statutes of all 18 NDPA states. No other individual has direct access to the production database or student data.

Juniper Reading CoLab does not use analytics services, advertising platforms, tracking pixels, or data brokers in any product that handles student data. The Supabase AI Assistant opt-in is set to Disabled, meaning no database schema, logs, or data are shared with third-party AI providers through the database platform.

2.4 Operational Safeguards

All code changes are deployed through a CI/CD pipeline from private GitHub repositories to Vercel. Deployments are logged. Database schema changes follow a documented migration process with explicit review, approval, and ledger tracking before application.

Stripe webhook signature verification prevents processing of forged payment events. Webhook events are logged to a dedicated audit table with event ID uniqueness constraints.

3. Training

Juniper Consulting LLC is a sole proprietorship operated by a single individual. The founder and sole operator maintains current knowledge of:

• FERPA requirements for educational technology providers, including the “school official” designation and its obligations under 34 CFR § 99.31(a)(1)
• COPPA requirements as they apply to teacher-mediated student access to educational technology
• New York Education Law § 2-d and the Commissioner’s Regulations at 8 NYCRR Part 121
• State-specific student data privacy requirements across the 18 NDPA alliance states

No employees or contractors have access to student data or personally identifiable information. Subprocessors (identified in Section 4) operate under their own privacy and security training programs and compliance certifications, and do not have discretionary access to student records outside their platform function.

4. Subprocessor Agreements and Contracting

Juniper Reading CoLab uses four subprocessors to operate its platform. Each handles only the minimum data required for its function and is bound by written data processing terms:

ElevenLabs is used for pre-generating audio narration files during content development. No student data is transmitted to ElevenLabs. Generated audio files are stored in Supabase Storage and served as static assets.

Each subprocessor is bound by its published Data Processing Agreement or equivalent contractual terms that prohibit use of data for purposes beyond providing the contracted service, prohibit re-disclosure to additional parties without authorization, and require implementation of reasonable security measures. Juniper Reading CoLab reviews subprocessor compliance posture annually.

5. Data Security and Privacy Incident Response

5.1 Incident Identification

Juniper Reading CoLab monitors for potential security incidents through:

• Supabase database and edge function logs, which record all authentication events, RLS policy violations, and function execution errors
• The audit_log table, which records student data access events with user ID, action type, resource type, IP address, and timestamp
• Stripe webhook logs, which record all payment and subscription events with processing status
• Vercel deployment logs, which record all application deployments
• Manual review of authentication patterns and access anomalies

5.2 Breach Determination and Classification

A “breach” is defined as any unauthorized release, disclosure, or acquisition of student data that compromises the security, confidentiality, or integrity of the data maintained by Juniper Reading CoLab. Good faith acquisition of student data by the founder in the course of operating the service is not a breach, provided the data is not used in violation of applicable law.

5.3 Notification Procedures

Upon confirmation of a breach involving student data:

• Within 24 hours: Initial notification to all affected LEAs. For Virginia LEAs, this satisfies the requirement under Virginia Code § 2.2-5514(c). For all other LEAs, this serves as the initial report pending the detailed notification.
• Within 72 hours: Detailed notification to all affected LEAs containing: (i) the types of personal information involved; (ii) the date or estimated date range of the breach; (iii) a general description of the incident; (iv) the estimated number of affected students; (v) the name and contact information of Juniper Reading CoLab’s representative for inquiries.
• LEAs are responsible for providing notice to affected students, parents, or guardians. Juniper Reading CoLab will cooperate with LEAs in preparing that notification.

5.4 Containment and Remediation

Upon identifying a suspected breach, the founder will:

1. Immediately revoke or restrict access to the affected systems or data
2. Preserve all relevant logs and forensic evidence
3. Determine the scope of affected data and the root cause
4. Implement corrective measures to prevent recurrence
5. Document the incident, response actions, and outcome
6. Cooperate with LEAs and, where applicable, the NYSED Chief Privacy Officer and law enforcement

5.5 Breach Cost Responsibility

Where a breach is attributable to Juniper Reading CoLab or its subprocessors, Juniper Reading CoLab will bear the costs of notification to affected LEAs and individuals, consistent with the obligations in the applicable state supplemental terms of the NDPA.

6. Data Transition

When a contract with an LEA ends or an LEA requests return of its data, Juniper Reading CoLab provides the following data transition mechanisms:

• On written request, Juniper Reading CoLab will export all student data associated with the LEA’s teachers in a standard machine-readable format (CSV) within 60 days, or within the timeframe specified in the applicable DPA.
• Teachers may export their own data at any time by contacting hello@juniperreadingcolab.com.
• Teachers may delete individual student records at any time from within the application.
• Data export includes: student names, assessment results, screener responses, lesson progress records, and session data.

7. Secure Data Destruction

Upon written request from an LEA, or upon termination of the DPA if no request is received, Juniper Reading CoLab will securely destroy all student data associated with that LEA.

7.1 Destruction Methods

Student data destruction is performed via hard deletion from the Supabase PostgreSQL database using a verified cascading deletion function (delete_account_full). This function executes 25 count-verified delete operations across all tables that hold student or teacher data, including student records, assessment results, screener responses, lesson progress, session data, Close Read activity records, app visits, coaching progress, entitlement logs, and audit log entries. Each operation counts expected rows before deletion and compares against actual rows deleted; any mismatch aborts the entire transaction. The function writes a deletion_records tombstone confirming the deleted user, student count, and class count. Dependent child records are removed through a combination of explicit function-managed deletion and database-level ON DELETE CASCADE constraints.

7.2 Destruction Certification

Following destruction, Juniper Reading CoLab will provide the LEA with written certification confirming: (i) the date of destruction; (ii) the categories of data destroyed; (iii) the method of destruction; and (iv) confirmation that no copies of the data remain in any Juniper system or subprocessor system, except for de-identified data as permitted by the DPA.

7.3 Automated Retention Practices

Student data associated with expired trials or cancelled subscriptions is retained until July 31 of the current school year (August 1 – July 31 cycle) or 90 days after the trial or subscription ends, whichever is later. Teachers receive email notification 30 days before any automatic data deletion.

8. Alignment with LEA Policies

Juniper Reading CoLab’s data security and privacy program is designed to align with the data security and privacy policies of the LEAs it serves. Upon execution of a DPA, Juniper Reading CoLab will review the LEA’s Data Security and Privacy Policy (where provided, such as in Exhibit J for New York LEAs) and confirm alignment.

Juniper Reading CoLab’s practices are designed to meet or exceed the requirements of the Parents’ Bill of Rights for Data Privacy and Security as required by New York Education Law § 2-d. Upon request, Juniper Reading CoLab will provide New York LEAs with a completed Parents’ Bill of Rights supplement.

Where an LEA’s policy includes requirements beyond those described in this DSPP, Juniper Reading CoLab will work with the LEA to document any necessary adjustments or to confirm that existing practices satisfy the requirement.

9. NIST Cybersecurity Framework Alignment

The following table describes how Juniper Reading CoLab’s data security and privacy practices align with the NIST Cybersecurity Framework v1.1, as required by 8 NYCRR Part 121 for New York LEAs and as referenced in the NDPA Exhibit F.

Document History

This Data Security and Privacy Plan is maintained by Juniper Consulting LLC and is subject to update.

© 2026 Juniper Reading CoLab — Juniper Consulting LLC. All rights reserved.