Security & Student Privacy

Last updated: October 24, 2026

Schools trust Dyyno with student information. This page explains, in plain language, how we protect it and how Dyyno fits a school's obligations under FERPA. For the full legal details, see our Privacy Policy and Terms of Service.

The short version

Your school's data is yours. We use it only to run Dyyno for your school. We never sell it, never use it for advertising and never use it to train AI.
Every school is kept separate. Each school works in its own space, and automated tests call every page of the app to check that one school can never see or change another school's records.
Read-only with Canvas. Dyyno reads course, enrollment and grade information from Canvas. It never changes anything in your Canvas account.
Encrypted and backed up. All connections use HTTPS, the school's Canvas API token is stored encrypted, and the database is backed up every day.

FERPA and student privacy

Under the U.S. Family Educational Rights and Privacy Act (FERPA), a school may share education records with a service provider that it treats as a "school official" with a legitimate educational interest, as long as the school stays in control of how the records are used. Dyyno is built to work that way:

The school owns the data. Student information in Dyyno belongs to the school. We process it only on the school's behalf, under its direction, to provide the service the school asked for.
The school decides who sees what. School administrators choose which Canvas account Dyyno reads, create every staff account and decide which information is shared with teachers and parents.
No other use. We do not sell student information, use it for advertising or marketing, build profiles from it, or disclose it to anyone except the service providers that host and secure Dyyno, or where the law requires it.
Parents' rights go through the school. Parents and eligible students who want to inspect, correct or delete records contact their school, and we help the school respond.
Deletion on request. When a school stops using Dyyno, or asks us to, we delete its information from the live service within 30 days, and it disappears from backups within a further 30 days. We can provide an export first.

If your school or state needs a signed data privacy agreement, contact us and we will work through it with you.

Who can see what

School administrators decide who gets access and create every staff account.
Counselors only see the campuses assigned to them; a counselor without campuses sees no students at all.
Teachers and parents use private links: long random codes that only show a teacher's own classes or one student's read-only report. The school can replace any link at any time, which stops the old one from working, and can set parent links to expire.
Important administrative actions, such as changes to school settings, the Canvas connection, campus assignments and teacher access, are recorded in an audit log.
Dyyno can open a school's workspace to provide support or fix a problem. Each time this happens it is recorded in the audit log.

Passwords are never stored in readable form (they are hashed with bcrypt).
Sign-in pages and teacher and parent links are protected against repeated guessing.
Staff can optionally use Sign in with Google. Dyyno only receives the Google account ID and email address, and keeps no Google passwords or access tokens.

Encryption

Every connection to Dyyno uses HTTPS, so information is encrypted on its way between the browser and our servers.
The Canvas API token a school gives Dyyno is encrypted before it is stored, with a key kept separately from the database. Staff only ever see the last few characters of it.

Where data is stored

Dyyno's servers and database are located in the European Union (Germany). Connections are delivered through a network security provider that protects the service against attacks, and which may process connections in other countries to deliver the service.

Backups

The database is backed up every day, and every backup is checked before it is kept.
A second copy is kept off the server, so information can be restored even if the server is lost. Restoring from it has been tested.
Backups are kept for up to 30 days and are then deleted automatically.

Reporting a security issue

If you believe you have found a security problem, please tell us right away at [email protected]. We read every report and will reply.

Questions from your IT or privacy team?

We are happy to answer a security questionnaire or walk your team through how Dyyno works. Email us or request a demo.