Security is part of the product boundary.

• Every tenant-owned database row carries a school identifier and Postgres Row-Level Security enforces isolation.
• The production application uses a non-owner database role that cannot bypass those policies. A release audit verified tenant reads, same-school writes, cross-school denial, referential integrity, audit history, and fail-closed behavior.
• Authentication sessions use secure server-side handling; dashboards and exports require an authenticated school relationship.
• Payment card data is collected by Stripe-hosted components when billing is enabled, not stored in Dojo Wizard application fields.
• Webhook signatures are verified before connected-account events are accepted.
• Baseline browser protections deny framing, limit browser permissions, prevent MIME sniffing, and restrict referrer data.
• A production database backup has been confirmed, and deployment and migration releases retain validation evidence.

Dojo Wizard does not currently claim SOC 2, ISO 27001, HIPAA, PCI Service Provider, or other third-party certification. Native apps, some self-service payment operations, production managed messaging, formal incident SLAs, a completed restore drill, and formal recovery objectives remain in progress. Staff-assisted Stripe billing is limited to approved pilot schools after the platform release gate, school-readiness review, and connected-account verification all pass, and it remains protected by an emergency collection switch.

Schools should validate workflows before a full cutover and retain appropriate backups and independent records for accounting, payroll, legal, medical, and safety decisions.

Email security@dojowizard.com with a clear description and reproduction steps. Do not include real member passwords, complete payment data, or unnecessary personal information.

For product support, use the support page.