How hayway protects childcare records
Childcare records are some of the most sensitive data a family will ever share. hayway is built with strong, modern security: per-center isolation, encrypted child records, and access that follows each person's role. This page lists the controls implemented today.
- Per-center data isolation
- Encrypted child records
- No SOC 2 certification claim
Children's data, protected at every layer
A child's file is some of the most sensitive data a family ever hands over. hayway defends it in depth: isolated per center, encrypted where it matters, scoped to who genuinely needs it, and logged so access stays accountable.
Your center, walled off from every other
The separation between centers is enforced in the database with tenant and role controls, not just on the screen, so each center's children, families, and finances stay scoped to that center.
Extra locks on the most sensitive details
Medical alerts, allergies, custody and incident notes, Social Security numbers and bank details each carry an added layer of field-level encryption at rest, so those fields are not stored in plain text alongside the rest of the record.
Access scoped to the role
Teachers see only the children in their assigned room. Directors see their own center. Parents see only their own child. Least-privilege by default, and nobody can hand out access they don’t already hold.
FERPA-style disclosure trail
Every view of a sensitive record and every disclosure to a parent is logged FERPA-style, with court-ordered custody restrictions enforced. You can answer who saw what, and when, without reconstructing it after the fact.
Signed incident reports lock
Once a parent signs an incident report, it locks from edits. Families and your center keep one stable, signed record of exactly what happened, with no quiet revisions later.
Two-step sign-in that survives staff turnover
Staff sign-in supports phone codes and passkeys, with backup codes so a lost phone never locks anyone out. Turn it on for everyone or just for leadership when you’re ready.
Strong, modern security without the enterprise overhead. We don’t sell or share family data, and access is scoped to the people who genuinely need it. To be straight with you: this is serious protection, not a HIPAA covered entity or end-to-end encryption, and we won’t claim otherwise.
How hayway protects childcare data
A plain-language look at the safeguards built into the platform, written to match how hayway actually works, not a generic security checklist.
Per-center tenant isolation
Every center's records are scoped to that center at the application layer and enforced again by Postgres row-level security in the database. Tenant queries run inside a row-level-security transaction, so one center cannot read another's data even through the same application.
Field-level encryption at rest
The most sensitive child information (medical alerts, allergy alerts, custody notes, medication and incident details) is encrypted at the field level with AES-256-GCM, on top of the disk and transport encryption protecting everything else.
Role-based access
Access follows the role, not a guess. Teachers see only the children in their assigned room, directors see their center, and parents see only their own children. Elevated actions are reserved for directors and admins.
Per-child FERPA gating
Direct-care staff are scoped to the specific children they care for, and access to sensitive records is checked per child. Disclosures to families are tracked in a FERPA-style log so you can answer who saw what, and when.
Audit logging
Sensitive reads, disclosures, and key actions are written to an audit trail tied to the center, so account activity is recorded and reviewable instead of reconstructed after the fact.
Multi-factor authentication
Multi-factor authentication is available for staff and admin accounts, adding a second factor on top of the password so a leaked credential alone is not enough to sign in.
Signed document URLs
Sensitive documents like invoices and recordings are served through short-lived signed URLs, not public direct-to-storage links, so a stray URL cannot expose a file to anyone who finds it.
Security headers, CSP & CSRF
The app ships a content security policy and security headers, and in-app mutations are protected by an application-wide CSRF check that verifies request origin for browser-based requests.
Signed, locked incident reports
Once a parent signs an incident report, it is locked from edits, giving families and your center a stable, signed record of what happened, backed by signature metadata.
Privacy you can put in writing
A few commitments we hold to on every record. They are simple on purpose: the kind of thing a director can repeat to a worried parent.
- We do not sell or share family data.
- Access is scoped to the people who genuinely need it.
- Child PHI/PII is encrypted at the field level, in addition to encryption in transit and at rest.
- Your data stays yours and is exportable if you ever decide to leave.
Honest about our security posture
hayway is an early, founder-built platform. We would rather tell you exactly what we run and what we are still working toward than dress it up.
SOC 2: not certified
hayway does not currently claim SOC 2 certification. This page describes implemented controls, not an independent certification.
Honest about where we are
hayway is an early, founder-built platform. We describe the controls we actually run, in plain language, and we would rather under-claim than oversell your families’ trust.
No security theater
We do not claim third-party penetration tests, NIST, or FISMA accreditation we have not earned. When we add an independent assessment, you will read about it on this page first.
See how your center's data is protected
Book a walkthrough and we will show you per-center isolation, encrypted child records, and role-based access in the platform, then discuss the security questions relevant to your center.
No long-term contracts. Built in New Albany, Indiana.
Evaluate security in context
Practical guides and source-cited state requirements for childcare operators.
Childcare software buyer’s guide
Use practical questions to evaluate security, exports, support, billing, and access controls.
Read resourceMulti-site access model
Review site-scoped roles, organization rollups, and organization-level controls.
Read resourceAsk a security question
Contact hayway about a specific control, data flow, or deployment requirement.
Read resource