Security

Prodigy Suite holds two things that deserve care: records about children, and the payment relationship between a studio and its families. Here is exactly how each is protected, and what we have not done yet.

Payment data

• Card numbers never reach our servers. A parent's card goes from their browser straight to Stripe, which returns a token.
• We store the last four digits and the card brand so a person can recognise which card is on file. Nothing else.
• Charges are made against the token through Stripe's API from server-side code. Nothing that can move money runs in the browser.
• Tuition settles into the studio's own Stripe account. We are not a money transmitter and never hold customer funds.

Access control

• Every read and write is checked by database security rules on the server, not just by the interface. Hiding a button is not a security control, so we do not rely on it.
• A parent account can only ever read its own family, students, enrollments and invoices.
• Instructors see rosters, medical notes and attendance. Balances, tuition settings and exports are limited to owners and admins.
• Role and subscription fields cannot be written by a browser. Only server-side code changes them, so an account cannot promote itself.

Infrastructure

• Hosted on Google Firebase: encrypted in transit (TLS) and at rest.
• Authentication is handled by Firebase Auth. We never see or store a plaintext password.
• Secrets — Stripe keys, webhook signing secrets — live in a managed secret store, never in the code or in the browser bundle.
• Webhook payloads are signature-verified before they are trusted.
• Two-factor authentication is available on owner and admin logins — a time-based code from an authenticator app, verified by Google Identity Platform rather than by us, so the second factor is checked before a session exists at all. A studio can require it of every owner and admin.

What we have not done yet

We would rather say this plainly than imply certifications we do not hold.

• No SOC 2 or ISO 27001 audit yet. It is on the roadmap, not on the wall.
• No third-party penetration test report to share yet.
• Two-factor authentication covers owners and admins. Instructor and parent logins can use it if the studio's Firebase project allows it, but it is not enforced for them.
• Text messaging is not built, so nothing sensitive is sent by SMS — because nothing is sent by SMS.

Reporting a vulnerability

Email security@prodigysuite.co with enough detail to reproduce the issue. We will acknowledge within two business days and keep you updated until it is fixed. We will not pursue legal action against anyone who reports a genuine issue in good faith and does not access or alter other people's data while doing it.