EMC Math Security Policy
Effective July 1, 2026
EMC Math is operated by Essential Math Concepts. This policy describes how we protect the data a district entrusts to us.
A district with a signed agreement may request fuller detail than this page gives, including our written responses to the data schedule and security questions in that agreement.
Data minimization
EMC Math is built to hold as little personal information as possible.
EMC Math stores no student names, no email addresses and no district student numbers. No table in our database has a column for any of them, and an automated check runs against the database structure to keep that true. A student is identified by the opaque identifier their own school system issues. That identifier carries no name and resolves to no person without the system that issued it. A student practicing with an access code has no identifier from their school at all, because none is sent to us.
Where a district sends a student number, we store a keyed one-way hash of it using HMAC-SHA256 with a secret held only on our server. The number itself is never stored and cannot be recovered from the hash.
Because EMC Math holds no list of student names, a breach of our systems could not expose one.
Encryption
All traffic is carried over HTTPS. We enforce TLS 1.2 or higher, and plain HTTP is redirected. Certificates renew automatically.
Data at rest is encrypted on the storage the service runs on.
Hosting and data location
EMC Math runs on Amazon Web Services, in one United States region in Northern Virginia. No data is processed or stored outside the continental United States.
The database is not reachable from the internet. It accepts no network connections, and only the application itself opens it. No database port is exposed and no database account exists for anyone to authenticate against.
The student applications and the teacher portal are static files served from Amazon storage through a content delivery network. Those files hold no personal information and no credentials.
Authentication
EMC Math issues no username and no password to any student. There is therefore no student password to be stolen, guessed or reused.
Where a district keeps its students' work with us, teachers and students arrive from their own school system and we issue them no credential either. A launch from Canvas is signed, and we verify it against the keys Canvas publishes. A sign-in from Clever uses an authorization code that we exchange on our own server rather than in the browser.
Where a school holds the version of EMC Math that identifies no student to us, its teachers sign in with a password we issue for that school. Every password we issue is stored as a one-way hash, using scrypt with a separate salt for each one, and never in readable form. A password is held only on our server and appears in no file the applications serve. A teacher's session on that arrangement lasts up to thirty days. Teachers who arrive from a content partner's platform sign in with that platform instead. The partner signs a link with its own private key, we hold only the matching public key, and each link lasts at most five minutes and works once.
Students on that arrangement sign in to nothing. A teacher generates a six-character access code for one activity. The code lasts twelve hours, the teacher can turn it off sooner, and it grants access to that one activity and to no record of any other student.
A session is a signed token the application holds in the browser and sends in a request header. It is not a cookie, and EMC Math sets no session cookie. The cookies EMC Math does set, one for each of its applications, remember a chosen display size and carry no identifier. Signing out clears the session.
A session token never travels in a query string, and the server refuses one that does. Where a sign-in hands a token to the application it travels in the part of the web address that browsers never send to a server, so it stays out of our access logs, and the application removes it from the address bar at once.
A session lasts no longer than the work needs. A Canvas launch lasts four hours. A Clever sign-in lasts eight. An administrator reading reports across schools gets thirty minutes on either route, because reading a report is a sitting rather than a standing permission.
A small number of administrator accounts are issued passwords by us at a district's request, so that an administrator who uses neither Canvas nor Clever can read their reports.
Repeated failed sign-in attempts are rate limited by client address and then blocked for a period. The limit is applied before any password is checked, and it is deliberately not applied per district, so that nobody can lock a district out by sending bad passwords at it.
Access control
Access follows the principle of least privilege. The server determines what a person may see rather than relying on anything the browser sends.
A student reads only their own work. A teacher reads the work of students in their own classes and no others. A school administrator reads their own schools. A district administrator reads their own district. Administrative routes on the server require a separate key that is issued to no district user.
Access to the systems that run EMC Math is restricted to the minimum number of people needed to operate it, uses key-based authentication rather than passwords, and requires multi-factor authentication on the hosting account.
Backups and recovery
The database is backed up every hour.
Each backup is taken while the service continues to run, so no write is lost and no copy is incomplete. Every backup is then verified. The copy is tested for integrity, compared against the source, and the compressed archive is test-extracted. A backup that fails verification is recorded as a failure and is not retained as a valid copy.
We keep every backup from the last 24 hours and the newest backup of each of the last 14 days. The most recent backup is retained whatever its age, so a backup job that stops running cannot remove the last good copy.
Our recovery point objective is one hour. Our recovery time objective is four hours.
Patching and vulnerability management
Application dependencies are tracked and updated, and known vulnerabilities in them are monitored. Operating system and runtime security patches are applied within 30 days of a critical release.
Incident response
If we confirm a breach affecting a district's data, we notify that district within 72 hours of confirming it. The notification describes what happened, the records and people affected, and the steps we have taken.
Application and server logs are retained and support an investigation.
A written incident response plan is being completed in December 2026 and will be tested at least once a year after that.
Audits and certifications
Essential Math Concepts does not hold a SOC 2 report or an ISO 27001 certificate.
Our hosting provider, Amazon Web Services, holds SOC 1, SOC 2, SOC 3, ISO 27001, PCI DSS and FedRAMP authorizations for the data centers and infrastructure the service runs on. Our sign-in and rostering provider, Clever, maintains its own security and privacy program.
A third-party penetration test is scheduled for December 2026 and annually from then. Reports are available to districts on request under a non-disclosure agreement.
Service providers
EMC Math uses two service providers, both located in the United States. Amazon Web Services provides hosting. Clever provides sign-in and class lists.
No analytics service, no advertising network, no error reporting service and no payment processor receives any district data. The applications load no fonts, scripts or stylesheets from any third party.
Credentials and keys for these integrations are held in the server environment and appear in no source file. We notify districts at least 30 days before adding a service provider.
Personnel
Access to district data is restricted to the minimum number of people required to operate the service. Everyone with that access is under a written confidentiality obligation and completes security awareness training at joining and annually after that.
No server, disk or backup holding district data is kept in any office of ours. We operate no premises that hold district data.
Reporting a vulnerability
If you believe you have found a security problem in EMC Math, please tell us at support@essential-math-concepts.com. We will acknowledge your report and keep you informed while we investigate.
Please do not test the security of EMC Math against live district data. Contact us and we will arrange a safe environment for testing.
Contact
Essential Math Concepts 518 N Tracy Ave Bozeman, MT 59715 support@essential-math-concepts.com