Security
Last updated October 11, 2026. ChoicePaid is operated by Hokuto Labs LLC.
Providers keep student and family records in ChoicePaid so they can bill for their services. Here is exactly how we protect them. If you find a security problem, contact us and we'll look into it right away.
Encryption
- Field encryption. Student and parent names, family email addresses, goals, private notes, progress notes, your EIN, family names and the full contents of every invoice are encrypted with AES-256-GCM before they reach the database. Each value gets its own random nonce, and tampering is detected.
- Files. Uploaded documents are encrypted the same way on our server before they're written to private storage, under random file names. Storage never sees the file or its name in readable form.
- A separate key. The encryption key is kept in our hosting provider's encrypted environment settings, not in the database. Someone with a copy of the database alone can't read the records.
- In transit and at rest. Every connection uses HTTPS (TLS). The database and file storage are also encrypted at rest by their providers.
Who can see records
- Only your workspace. Every query is scoped to your workspace. On Pro and School, the teammates you add share it; you can remove them at any time.
- No passwords to steal. Sign-in is by a one-time link sent to your email, and sessions are stored server-side so they can be ended.
- Activity log. Owners can see who viewed, downloaded, sent or changed student records, and when, in Account, then Activity.
- Family pages. A family page is a private link you create for one student. We store only a one-way fingerprint of the link, pages are hidden from search engines and never send a referrer, and you can turn a link off instantly. Links sent by email are replaced each time you send a new one.
- Calendar feeds show students by initials only, because calendar apps copy events to their own servers. Reminder emails also use initials.
- No analytics on private pages. Google Analytics is switched off on account, family and sign-in pages, and our own page counts strip secret links and record IDs from URLs.
What we never do
- Sell, rent or share student records with anyone, including state programs and payment platforms.
- Use student records for marketing, advertising, analytics or training AI models.
- Take a percentage of education funds, or touch them at all.
Deleting and exporting
Delete a student and their sessions, invoices, documents and family links are removed immediately, including the stored files. Delete your account and everything in your workspace goes with it. You can download everything we store about you, decrypted, as JSON from your account page at any time.
Services we use
Vercel (hosting, encrypted environment settings and private file storage), Neon (database), Resend (email), Lemon Squeezy (payments for paid plans) and Google Analytics (public pages only). See the privacy policy for the full details.
What we don't claim
We don't hold a SOC 2 report or any other third-party security certification yet, and we don't claim one. We built the protections above because the records are about children.
Questions
Can ChoicePaid staff read my students' records?
Names, notes, goals, progress notes, your EIN, invoice contents and uploaded files are encrypted before they're saved, and the key is kept separately from the database. Our application can decrypt them to show them to you; we don't look at them unless you ask us to help with a specific problem.
Do you share student data with state programs or payment platforms?
No. We never send student records to any program, payment platform or anyone else. You decide what to submit, and you submit it yourself.
Is student data used to train AI or for advertising?
No. Student records are never used for marketing, advertising, analytics or training AI models, and analytics tools are switched off on every page that can show them.
What happens to records when I delete a student or my account?
They're deleted immediately, including uploaded files in storage. Deleting your account removes everything in your workspace. If you move to the Free plan, your records are kept (not shown) until you return or delete them.