Security at KiddieTrac

KiddieTrac holds some of the most sensitive information there is: children's records, family contacts, health notes and billing. Protecting it is part of how we build every feature:

• Encrypted connections (TLS) for the website, the portal and the apps.
• Two-factor sign-in and passkeys, with role-based access so each person sees only what their role allows.
• Each agency's data kept separate from every other agency's, with automated checks that look for data crossing between them.
• An audit log of sensitive actions, and security alerts on suspicious sign-in activity.
• Automated nightly backups, stored away from the website and checked that they ran.
• Card payments handled by our payment processors, so KiddieTrac never stores full card numbers.

Shared responsibility

We secure the platform and its code. Agencies and families keep their own accounts safe: use a strong, unique password or a passkey, turn on two-factor sign-in, never share a login, and remove access for staff who leave.

How to report a vulnerability

Email info@kiddietrac.com with the subject line Security report. Please include:

• What the issue is, and where: the page, screen, URL or API endpoint.
• Step-by-step instructions to reproduce it, in the body of the email (text, or PNG/JPG screenshots). Please don't send other attachments.
• What an attacker could do with it, as you understand it.
• How to reach you, and the name or handle you'd like to be credited with.

If you came across anyone else's personal information, please don't include it in your report. Describe it instead, and delete anything you saved.

What happens next

• We aim to acknowledge your report within 3 business days.
• We'll confirm whether we can reproduce it, and keep you updated while we work on a fix.
• We prioritise by severity and by the risk to families' information. Anything that could expose one agency's or family's data to someone else comes first.
• We'll tell you when it's fixed and, if you'd like, credit you.

In scope

www.kiddietrac.com, app.kiddietrac.com, api.kiddietrac.com, and the KiddieTrac mobile apps. We're especially interested in:

• Access to another agency's, family's or person's data (broken access control, IDOR, tenant isolation).
• Authentication and session flaws: sign-in, password reset, two-factor, passkeys.
• Cross-site scripting (XSS) and cross-site request forgery (CSRF).
• SQL injection, server-side request forgery (SSRF), template injection and remote code execution.
• Exposure of sensitive data, and TLS or HTTPS misconfiguration.

Out of scope

• Social engineering or phishing of our staff, agencies or families.
• Physical attacks, and attacks that need access to someone's unlocked device.
• Denial of service, load or volume testing, and anything that degrades the service for others.
• Spam or rate-limit findings without a security impact, and self-XSS.
• Missing best-practice headers or settings with no demonstrated way to exploit them.
• Issues that need the victim to install unusual software or use an unsupported browser.
• Bugs in third-party services we use (for example payment, messaging or email providers). Please report those to the provider.
• Visual and usability bugs. Please tell us through the contact page instead.

Testing in good faith

• Use only accounts you own or that we've given you for testing. Never another person's account.
• If you reach someone else's information, stop there, don't view, change or keep more than you need to show the problem, and report it straight away.
• Don't run automated scanners at a volume that affects the service, and don't send messages, texts or calls to real families.
• Give us a reasonable time to fix the issue before you share it with anyone else.

If you act in good faith and follow this policy, we'll treat your research as authorised, work with you to understand and fix the issue, and won't pursue legal action against you for it.

Recognition

We're grateful to everyone who helps keep KiddieTrac safe. With your permission, we'll thank you by name or handle once the issue is fixed. We don't offer monetary rewards.

Last updated: September 29, 2026

Our commitment

KiddieTrac is committed to treating everyone with dignity and independence, and to giving people with disabilities the same opportunity to use our products and services, and to work with us, as everyone else. We meet our obligations under the Accessibility for Ontarians with Disabilities Act, 2005 (AODA), its Integrated Accessibility Standards, and the Ontario Human Rights Code, and we work to identify, remove and prevent barriers.

Accessible by design: our website, portal and apps

We design KiddieTrac to work for as many people as possible and use the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA as our standard for the website, the portal and the mobile apps. We are reviewing our screens against it and fixing what we find. Today:

• The portal is available in English, French, Spanish and Hindi, and our website in English, French and Spanish.
• Families can choose how they hear from their centre — in the app, by email, by text, or by an automated phone call for urgent notices — so important information doesn't depend on one way of reading it.
• The portal works in a web browser, on phones and tablets, and in our mobile apps, so people can use the device and assistive tools they already rely on.
• Parts of the portal respect your device's "reduce motion" setting.

If any part of KiddieTrac is hard to use with your assistive technology, please tell us. We'll help you get the information or complete the task another way while we fix it.

Customer service

• Assistive devices: people may use their own assistive devices to access our services.
• Support persons: a person with a disability may be accompanied by a support person in any meeting, training or demonstration.
• Service animals: service animals are welcome anywhere we meet with customers in person.
• Communication: we communicate in a way that takes a person's disability into account — for example by email instead of phone, with more time, or in plain language.
• Service disruptions: if a planned or unplanned disruption affects the service, we post notice in the portal and by email, with the reason, how long it's expected to last, and any alternatives.

Information and communications

On request, we provide our public information — including this policy, our guides and emergency or safety information — in an accessible format or with communication supports, in a timely manner and at no extra cost. We'll work with you to find a suitable format. If something truly can't be converted, we'll explain why and give you a summary.

Employment

• We tell applicants that accommodations are available throughout recruitment, from applying to interviews and assessments, and to new hires as part of onboarding.
• We work with employees who have disabilities on individual accommodation plans, and with those who need it on individualized workplace emergency response information.
• We take accessibility needs into account in performance management, career development and return-to-work.
• Workplace information is available in accessible formats on request.

Training

Everyone who works for or on behalf of KiddieTrac receives training on the AODA's Integrated Accessibility Standards and the Ontario Human Rights Code as it relates to people with disabilities — including how to communicate with people with different disabilities and how to help someone using an assistive device, a service animal or a support person. New team members are trained as part of onboarding, and training is refreshed when our policies change.

Feedback

We welcome feedback about how we provide accessible products and services. Email info@kiddietrac.com with the subject Accessibility, or use our contact form. Feedback can also be given in another format on request. We aim to acknowledge feedback within 5 business days and to tell you what we'll do about it.

Changes to this policy

We review this policy regularly and whenever our products or obligations change. Any policy that doesn't respect and promote the dignity and independence of people with disabilities will be modified or removed.

Last updated: September 29, 2026

Why it matters to us

KiddieTrac serves childcare providers and the families who trust them — families of every background, culture, language, faith, ability and shape. We believe a diverse team builds better software for them, and that an equitable, inclusive workplace is simply the right way to work.

Scope

This policy applies to everyone who works for or with KiddieTrac — employees, contractors and applicants — and to how we treat our customers, partners and the families who use our products.

Equal opportunity and non-discrimination

We do not discriminate on any ground protected by the Ontario Human Rights Code or other applicable law, including race, ancestry, place of origin, colour, ethnic origin, citizenship, creed, sex (including pregnancy), sexual orientation, gender identity, gender expression, age, marital or family status, and disability. Hiring, pay, promotion, training and every other employment decision is based on the requirements of the job and a person's qualifications, skills and contribution.

Inclusive hiring

• Job postings describe what the role truly requires and invite applicants to request accommodations.
• Candidates for a role are assessed against the same criteria, by more than one person where possible.
• We look beyond our immediate networks when we recruit, so that more people hear about our opportunities.

A respectful, inclusive workplace

• We don't tolerate harassment, discrimination or bullying of any kind, and we act on every concern raised.
• We provide accommodation to the point of undue hardship, including for disability, religious observance and family status (see our Accessibility Policy).
• We respect the names and pronouns people use, and we build flexibility into how and when work gets done where the role allows.
• Everyone is expected to contribute to an environment where people can speak up, disagree respectfully and do their best work.

Inclusive by design: our product

• The portal is available in several languages — English, French, Spanish and Hindi — so families and educators can use it in the language they're most comfortable with.
• Children's records include pronouns and preferred names, and cultural and dietary notes, so educators can care for each child as the family asks.
• Families are made of guardians of every kind: our records let a family name each guardian and their relationship to the child, rather than assuming two parents.
• Families choose how they hear from their centre — app, email, text or phone — so information reaches everyone.
• We consider the needs of diverse families and educators when we design new features, and we welcome feedback when we get something wrong.

Raising a concern

Anyone who experiences or sees behaviour that goes against this policy is encouraged to raise it with their manager or by emailing info@kiddietrac.com. Concerns are handled promptly, fairly and as confidentially as possible. We do not tolerate retaliation against anyone who raises a concern in good faith.

Accountability

KiddieTrac's leadership is responsible for this policy. We review it at least once a year, alongside our hiring and workplace practices, and update it as we learn.

Why it matters

A childcare account holds names, photos, addresses, health notes and payment details. That makes it worth protecting carefully. Most online harm doesn't come from sophisticated attacks: it comes from a reused password, a convincing fake email, or a photo shared further than intended. A few good habits go a long way.

How KiddieTrac protects your information

Tips for parents and guardians

• Use a strong, unique password. At least 12 characters, not used on any other site. A passphrase of a few unrelated words is easy to remember and hard to guess. Better still, turn on a passkey or two-factor sign-in.
• Check before you click. KiddieTrac emails come from kiddietrac.com or from your own childcare provider. If a message feels urgent, unusual or asks you to pay somewhere new, open the app directly instead of using the link.
• Share photos thoughtfully. Photos from your centre often include other children. Please keep them private, and ask before posting anything that shows someone else's child.
• Keep your details current. Up-to-date phone numbers, emergency contacts and pickup permissions help your centre reach the right people quickly.
• Sign out on shared devices, and keep your phone's software up to date.

Tips for educators and directors

• Never share a login. Every team member should have their own account, so access matches their role and the record shows who did what.
• Use the app for family photos and messages rather than personal phones, texts or social media.
• Lock your device when you step away, and remove access promptly when someone leaves your team.
• Be wary of unexpected requests to change a family's payment details or contact information; confirm them in person or by a known phone number.

Talking with children about the internet

Online safety starts early. Keep screens in shared spaces, explore together, and let children know they can always tell a trusted adult if something online makes them feel worried or uncomfortable — and that they won't be in trouble for telling.

Seen something suspicious?

If you receive a message that claims to be from KiddieTrac but doesn't feel right, or you think someone else has accessed your account, contact us right away at info@kiddietrac.com or 1-855-400-9996, and change your password. For concerns about your child's own records, you can also speak with your childcare provider.