Security Overview

1. All Wendel personnel with access to production systems are subject to a documented background check prior to commencement of duties, to the extent permitted by applicable law.
2. All personnel execute confidentiality undertakings and acknowledge the Acceptable Use Policy as a condition of employment or engagement.
3. Personnel complete mandatory information-security and privacy training upon onboarding and at least annually thereafter; completion is tracked.
4. Access to production systems is revoked within twenty-four (24) hours of separation from Wendel or upon a documented change in role.

Access to production systems is granted on the principles of least privilege and need-to-know. All administrative and engineering access requires multi-factor authentication (MFA) using FIDO2 hardware security keys or equivalent phishing-resistant authenticators. Shared credentials are prohibited; every action is attributable to a specific named identity.

End Users authenticate to the Services through the School's configured identity provider (typically Google Workspace for Education or Microsoft Entra ID) or through Wendel-issued credentials secured with bcrypt password hashing (cost factor 12 or greater) and rate-limited login attempts.

School Data is encrypted in transit using Transport Layer Security version 1.2 or later, with cipher suites limited to those rated "recommended" by the Mozilla SSL Configuration Generator. All certificates are issued by a publicly trusted certificate authority and rotated automatically at least ninety (90) days prior to expiration.

School Data is encrypted at rest using the Advanced Encryption Standard with 256-bit keys (AES-256). Cryptographic keys are managed by Wendel's managed infrastructure provider using FIPS 140-2 validated hardware-security modules. Application-level secrets (such as API tokens and database credentials) are stored in a dedicated secrets-management system with access logged and audited.

1. All session cookies are issued with the HttpOnly, Secure, and SameSite=Lax attributes.
2. Cross-Site Request Forgery (CSRF) protections are applied to all state-mutating endpoints.
3. A Content-Security Policy header is set on all responses to restrict script sources to Wendel-controlled origins.
4. Input validation is performed at the application layer using strict schemas; parameterized queries are used exclusively at the database layer.
5. Rate-limiting is applied to authentication, attendance check-in, and rotating-QR-code generation endpoints to mitigate enumeration and abuse.

Wendel monitors first-party and third-party dependencies for known vulnerabilities through automated dependency scanning and the National Vulnerability Database. Critical-severity vulnerabilities in production components are remediated within seven (7) days of discovery; high-severity vulnerabilities within thirty (30) days; medium-severity within ninety (90) days, in each case subject to availability of a vendor-supplied fix.

Annual third-party penetration testing is conducted against the production environment. The most recent report is made available to Schools under DPA upon written request subject to a customary confidentiality undertaking.

1. All code changes are reviewed by at least one engineer other than the author prior to merge to the main branch.
2. Continuous integration runs static-analysis and dependency-vulnerability checks on every pull request.
3. Production deployments are performed exclusively through an automated continuous-deployment pipeline; manual deployment to production is prohibited absent a documented break-glass procedure.
4. Feature flags are used to roll out high-risk changes incrementally; rollbacks are achievable within minutes.
5. Threat modeling is performed for any new feature that introduces a new data-flow or trust boundary.

Wendel intends to commission an independent third-party SOC 2 Type II examination once it satisfies the applicable audit-readiness thresholds (typically twelve (12) months of operational history with the controls in effect). Pending the availability of a SOC 2 Type II report, Wendel will provide, upon written request and subject to a customary confidentiality undertaking:

1. Wendel's written information-security policies;
2. the most recent third-party penetration-test summary;
3. the current Subprocessor list with each Subprocessor's compliance certifications; and
4. a written response to a reasonable security questionnaire submitted by the School.