Security at ZorvGuard
The short version: we keep as little student data as possible, nothing about student browsing is written to disk, and your school can export or delete everything at any time.
Data we keep (and don't)
- Screenshots and open tabs are never stored. They stream to the teacher's screen only while that class is in session and a teacher is watching, then they're gone.
- No browsing history. Reports are daily totals per site (like "poki.com: 40 blocked attempts"), never which student visited what.
- Safety alerts are matched on the device. Only searches that match self-harm or violence phrases are sent, and only if your school turns alerts on. They're deleted after 90 days.
- Blocked search words are checked on the device and the search is never sent to us.
- Attendance, class history, unblock requests, and the activity log are deleted automatically after one year. See the retention table.
Who can see what
- Teachers see only the students in their own rooms (and rooms shared with them), and only during class.
- Admins manage their own school. Schools can never see each other's data.
- Students can always see when their screen is being viewed: the ZorvGuard icon shows LIVE.
- Every staff action that changes settings, staff, or rooms is recorded in your school's Activity log, including when an override password is used.
Accounts and sign-in
- Passwords are stored only as salted scrypt hashes. We can't see or recover them.
- Sign-in attempts are rate limited per email and per network to stop password guessing. Override-password attempts are limited per device and per school.
- Sessions use long random tokens and expire after 12 hours (or 7 days if a staff member chooses "Keep me signed in"). Changing a password signs out every other device.
- Setup links work once and expire after 7 days; password-reset links after 1 hour.
- Schools can use Sign in with Google for staff. We verify Google's sign-in token and never see the Google password.
Connections
- The dashboard, the API, and every student device connect over HTTPS and secure WebSockets (TLS). Browsers are told to always use HTTPS (HSTS).
- The dashboard sends strict security headers: a content security policy, no framing by other sites, and no camera, microphone, or location access.
- ZorvGuard uses no third-party analytics, ad trackers, or outside fonts.
On student devices
- The extension is force-installed by your IT admin through Google Admin, so students can't remove it. It only connects to your school's account using the enrollment key in your policy.
- Override passwords are checked by our server and are never stored on student devices.
- The extension runs no remote code; every update goes through the Chrome Web Store.
Your school stays in control
- Export everything: School account → Download all school data gives you one file with everything we store for your school.
- Delete everything: School account → Delete all school data removes it immediately.
- You can rotate the device enrollment key at any time.
Student privacy laws
ZorvGuard acts on your school's behalf, under your school's direction, as described in our Privacy Policy. We don't sell student data, use it for advertising, or use it to train AI models. Districts can sign a data privacy agreement with us; email privacy@zorvcloud.com.
Report a security issue
If you think you've found a security problem, please email privacy@zorvcloud.com with the details. Please don't access other people's data or disrupt the service while testing. We'll reply as quickly as we can and keep you updated while we fix it.