Drivia is built for K-12 districts, universities, parents, and learners. This page is the short version of how we protect you — and the smaller, more important version of what you can do to protect yourself.
You do. Drivia Kids accounts are parent-created — you set the username and password, and you receive a two-step confirmation email under federal COPPA law before your kid can sign in. We never ask your kid for an email address.
Their first name (you supply), their age (you supply), the username and password you set, their learning progress (lessons completed, mastery scores, XP), questions they ask the AI tutor, optional voice clips when they use voice mode, their device IP, and a persistent device ID for session continuity. That's it. We don't collect last name, home address, phone, geolocation, photos, biometrics, or government ID.
Open your parent dashboard → Kids → pick your kid → tap Export all data (JSON). You get the entire record, including the audit trail of every consent event. You can also hard-delete the whole account from the same page.
Someone tried to sign in too many times with the wrong password. We automatically pause sign-in for 30 minutes and email you. If it was your kid forgetting, sit with them and try again after 30 minutes. If you don't recognize the activity, change their password right away from the parent dashboard.
No. No ads of any kind in the kid surface, no behavioral profiling, no data sold to ad networks. Ever.
Open your parent dashboard → Kids → pick your kid → reset their password (we send the reset link to your email, not theirs). Then turn on Pause sign-in until you've confirmed the situation. If you suspect any data was accessed, email wilson@drivia.consulting — we treat parent reports as P0 incidents.
Your password and any access codes your school issued you. Drivia will never ask for your password in an email, in a chat, or over the phone — if anyone does, that's phishing. Drivia staff don't need your password to help you; we can reset it from the admin side.
A link that looks like Drivia but the URL is slightly off (drivia-login.com, drivla.consulting, etc.). A message saying your account will be deleted in 24 hours if you don't click. An attachment claiming to be a Drivia document. An email asking you to "verify" your password. Real Drivia emails come from @drivia.consulting, link only to drivia.consulting or your school's subdomain (school-name.drivia.consulting), and never ask you to type a password into an email.
Always start from your district portal. The portal hands a signed token to Drivia and you never type a Drivia password. If you find yourself typing a password into a Drivia screen after going through your district portal, stop and tell your IT contact — that's a sign something is mis-configured or someone is impersonating Drivia.
Open your account settings → Security (coming this week). You'll see every active session and recent sign-in. Revoke any session that wasn't you, change your password, and email wilson@drivia.consulting with the details.
Every row of data in Drivia carries an organization ID, and database-level policies enforce that one organization can only read its own data. The policy layer is audited monthly and pre-onboarding against the multi-tenant isolation matrix v1.4 (596 production tables scored). The database refuses cross-organization reads even if app code were to ask for them.
Sector-aware breach notification is wired into the database — when a security incident is detected, the system auto-computes the tightest notification deadline across FERPA, HIPAA, CJIS, GLBA, and COPPA based on the affected tenant's sector flag, and surfaces it for legal review within the regulatory window. We also keep an immutable audit trail of admin actions so we can answer "who saw what when" for any investigation.
Yes. SAML 2.0 is supported per-tenant, and we're a certified partner in the K-12 district portal ecosystem. Your IT team configures the identity provider in your tenant admin dashboard; we never hold your password.
SOC 2 Type II is in progress. Type I bridge timeline and Type II issuance date are tracked in our compliance evidence pack — request a copy with an NDA via wilson@drivia.consulting.
Email wilson@drivia.consulting with the details. We treat responsible-disclosure reports as P0 and respond within one business day. No bug-bounty payouts yet (we're bootstrapped) but we credit researchers on this page on request.