Security & incident response

• All traffic is encrypted in transit (HTTPS) and data is encrypted at rest by our hosting provider.
• Every family's data is isolated at the database level: a signed-in parent can only ever read or change their own family's rows, enforced by the database itself, not just by the app.
• Child sign-in codes are stored only in scrambled (hashed) form — we never store the actual code.
• Five wrong child codes in 15 minutes temporarily lock that child's sign-in.
• New devices must be approved by the parent by email before any child can use them.
• Security-related events (sign-ins, wrong-code attempts, device approvals, admin actions) are recorded in an audit log kept for 24 months.
• The administrative area is restricted to the site owner only, and every administrative action is logged.
• Staff access is limited to the owner of ASM Professional Services.

Card payments are handled entirely by Stripe. We never see or store your full card number. Webhook events from Stripe are signature-verified and processed exactly once.

1. We contain the incident and stop any further unauthorised access.
2. We assess which families and which data are affected, using the audit log.
3. Where the law requires it, we notify the relevant regulator within 72 hours of becoming aware (for example the Dutch Autoriteit Persoonsgegevens).
4. If the incident is likely to put you or your child at risk, we email affected parents without undue delay, explaining what happened, what we have done and what you should do.
5. We record the incident, its cause and the fix, and change our systems so it cannot happen the same way again.

If you believe you have found a security problem, please email support@mathidiajunior.com with the subject "Security". Please do not share the details publicly until we have had a reasonable chance to fix it. We acknowledge reports within one working day.

• Choose a child code that is not a birthday or "1234".
• Remove devices you no longer use from your dashboard.
• Sign out of the parent zone on shared computers.
• Keep your account email secure — it controls device approvals and deletion.

See also the child safety policy and the privacy notice.