Security
Last updated 18 August 2026
Prodigy Suite holds two things that deserve care: records about children, and the payment relationship between a studio and its families. Here is exactly how each is protected, and what we have not done yet.
Payment data
- Card numbers never reach our servers. A parent's card goes from their browser straight to Stripe, which returns a token.
- We store the last four digits and the card brand so a person can recognise which card is on file. Nothing else.
- Charges are made against the token through Stripe's API from server-side code. Nothing that can move money runs in the browser.
- Tuition settles into the studio's own Stripe account. We are not a money transmitter and never hold customer funds.
Access control
- Every read and write is checked by database security rules on the server, not just by the interface. Hiding a button is not a security control, so we do not rely on it.
- A parent account can only ever read its own family, students, enrollments and invoices.
- Instructors see rosters, medical notes and attendance. Balances, tuition settings and exports are limited to owners and admins.
- Role and subscription fields cannot be written by a browser. Only server-side code changes them, so an account cannot promote itself.
Infrastructure
- Hosted on Google Firebase: encrypted in transit (TLS) and at rest.
- Authentication is handled by Firebase Auth. We never see or store a plaintext password.
- Secrets — Stripe keys, webhook signing secrets — live in a managed secret store, never in the code or in the browser bundle.
- Webhook payloads are signature-verified before they are trusted.
What we have not done yet
We would rather say this plainly than imply certifications we do not hold.
- No SOC 2 or ISO 27001 audit yet. It is on the roadmap, not on the wall.
- No third-party penetration test report to share yet.
- Two-factor authentication for staff accounts is planned and not shipped.
Reporting a vulnerability
Email security@prodigysuite.co with enough detail to reproduce the issue. We will acknowledge within two business days and keep you updated until it is fixed. We will not pursue legal action against anyone who reports a genuine issue in good faith and does not access or alter other people's data while doing it.