Security

Encryption

• Every connection to Fish, from the web and the apps, is encrypted (HTTPS).
• The database, its backups and uploaded files are encrypted where they're stored.
• The most sensitive values, such as the keys a school uses to connect its student information system, are encrypted again inside the database.

Signing in

• Fish has no passwords. You sign in with a link sent to your email, which expires after 15 minutes, or with a passkey kept on your own device.
• In the app, you can see the devices signed in to your account and sign any of them out.

Who can see what

• Access follows each person's role at their school: a teacher sees their classes, a parent their own children, the office what its permissions allow.
• The most sensitive powers, such as sending urgent alerts to every family or connecting AI assistants, are never given by a role. Each has to be granted to each person by name.
• Only a few people at Attack Penguin can reach the systems Fish runs on, each with their own named account.
• Our support staff can view Fish as one of a school's people only while that school has support access turned on. Each session is recorded, and the school can read the record.

How we build Fish

• No change reaches Fish without passing automated tests and security scans of our code and of every library it uses; nobody, including us, can skip them.
• Error reports are sent without personal information.
• We keep a written security program, review it every year, and rehearse what we'd do in an incident.

If something goes wrong

We tell affected schools within 72 hours of confirming that information was exposed, and help them notify families as the law requires.

Found a problem?

If you think you've found a security weakness in Fish, please write to hello@attackpenguin.com before telling anyone else. We'll answer quickly and keep you updated.