Security
Your data, locked down.
How Volanee protects what volunteers, parents, schools and organizations trust it with, in plain words: who can see what, what our own team can see, how it is stored, and what we have not done yet. Volanee is free, and that doesn’t make you the product: no ads, and we never sell data.
Access
Who sees what.
Every screen is built on these rules, and the server enforces them on every request, not the page.
| Information | The student | Their parent | An organization they signed up with | Their school’s verified counselor | Club officers and advisor | Volanee staff |
|---|---|---|---|---|---|---|
| Name and school | Yes | Yes | Yes | Yes | Members only | Yes |
| Date of birth | Yes | No | No, only whether they are old enough | No | No | To answer a request or a report |
| Phone and home address | Yes | No | Never | Never | No | To answer a request or a report |
| Verified hours | Yes | A weekly total | Only hours at that organization | Yes | If the student joined the club | Yes |
| Parent permission | Yes | Yes | No | Whether it was given | No | Yes |
| Updates from an organization | The ones sent to them | The ones sent to their teen | The ones it sent | No | No | Only when a report is filed |
| Documents (TB test, immunizations, forms) | Yes | No | Only what the student attaches to a request | No | No | Each opening is logged |
| Answers and signed waivers | Yes | No | Only for its own posts | No | No | Only when a report is filed |
| Court case number (adults) | On their own letter only | No | Never | Never | No | Not shown on any staff screen |
| Where their phone is | Never collected | Never collected | Never collected | Never collected | Never collected | Never collected |
A counselor sees any of this only after Volanee verifies they work at the school, and only for students who named that school. Club officers see members’ hours only because the member chose to join. Adult volunteers have the same protections; the parent column just doesn’t apply.
Our team
What Volanee can see.
We would rather say it plainly than hide behind the word encrypted.
What encryption protects against
Sensitive fields are encrypted with a key kept apart from the database. Someone who copied the database or a backup would get unreadable data. The server unlocks a field only to show it to a person allowed to see it.
What our team can open
A few people at Volanee can look at an account to answer a help request, review an ID, check an organization or follow up a safety report. Every time they open an account, it is logged with who and when, and kept for 24 months.
What we never do
We never sell data, show ads, or share your information with anyone you didn’t sign up with. ID photos are destroyed after the review, and court case numbers aren’t shown on any staff screen.
Protection
How it is protected.
Encrypted at rest
Dates of birth, phone numbers, home addresses, parent and supervisor emails, updates, reflections, ID results, court case numbers and documents are encrypted with AES-256-GCM before they are stored. Daily backups are encrypted too.
Passwords done properly
Hashed with scrypt, never stored. Checked against known breached passwords without sending them anywhere. Repeated wrong guesses lock the account for a while.
Tested by attacking it
Every one of the app’s API routes was tried with another school’s, club’s, organization’s and family’s records, as six kinds of outsider. None got through. The test is repeated after changes.
Web protections
A strict content security policy with no inline scripts, same site cookies that scripts cannot read, checks against cross site requests, and rate limits on sign in, codes and search.
Links nobody can guess
IDs in addresses are opaque. Reset, permission and supervisor links are long random values that expire or work once. A reset signs out every device.
The least data that works
Volanee never asks where your phone is; search uses the ZIP code you type. A school never sees a supervisor’s personal contact details. Errors are logged without anything about who hit them.
An audit trail
A counselor opening a record, staff exporting data, every verification decision: logged with who and when, and kept for 24 months.
Your data, in your hands
Anyone can download everything Volanee holds about them from Settings, and delete their account. A parent can withdraw permission from their link at any time.
Organizations are checked first
An organization gets an account only after a person on our team checks it, and school counselors are verified before they see any student. Adults who can work with students show a photo ID.
Incidents
If something goes wrong.
Reporting a security problem
Found a weakness? Email security@volanee.app or use Get help in the app. We will look at every report and reply. Please do not access other people’s data to prove a point.
If there is a breach
If we learn of a breach that affects your information, we will tell the people and schools affected promptly, as the law requires, and say what happened and what we are doing about it.
Critical safety reports
A report that someone may be at risk freezes the placement, preserves the evidence and alerts our staff right away. See Safety.
Being straight about it
What we have not done yet.
No outside audit yet
Volanee has not had an independent penetration test or a certification such as SOC 2. The testing above is our own. An outside test comes before any district wide rollout.
A small team
Reviews of IDs, organizations and counselor checks are done by people on a small team, which is why a new organization can take a day to be approved.
Checks reduce risk; they do not remove it
No system is perfectly secure. We would rather tell you exactly what we do than claim more.
Questions from a school or district?
Ask about anything on this page and we will answer it in writing, before any student joins.