Built to protect what centers keep in it.
MyLittleWorld holds children's records, family contact information, and payment data. We treat that with the seriousness it deserves — here's how.
Tenant isolation at the database layer
Every query is scoped by Postgres Row-Level Security, not just application code — so one organization's data can't leak into another's, independent of any bug in a page or API route.
Role-based access, enforced server-side
Owner, Director, and Staff roles gate what a person can see and do, checked on every request — not just hidden in the interface.
An audit trail on sensitive actions
Changes to records like enrollment, billing, and staff information are logged, so a director can see who did what and when.
Payments handled by Stripe
Card numbers are collected and stored by Stripe, a PCI-DSS Level 1 payment processor — MyLittleWorld's own servers never see or store full card details.
Infrastructure
MyLittleWorld runs on Supabase (managed Postgres, authentication, and file storage) and is hosted on Vercel. All traffic to and from MyLittleWorld is encrypted in transit. Authentication supports multi-factor login (TOTP) for staff accounts.
Who can see what
Access follows each person's role in their organization. Teachers see the classrooms and children they're assigned to; billing, staff records, and organization-wide messaging are restricted to Owners and Directors. Guardians only ever see their own children's information.
Your organization's data is yours
We don't sell customer data, and we don't use the children's or families' information in your account for advertising. Full detail on what we collect and why is in our Privacy Policy.
Vulnerability management
We apply automated dependency and vulnerability scanning as part of our regular development process. We also run a Vulnerability Disclosure Policy that invites independent security researchers to report issues they find, with a safe-harbor commitment for good-faith reports.
Compliance roadmap
We'd rather be direct about where we are today than vague about where we're headed. MyLittleWorld does not currently hold the following, but they're active roadmap items:
- SOC 2 Type II certification — not yet obtained, in progress toward
- ISO 27001 certification — not yet obtained, in progress toward
- Third-party penetration testing — not yet performed; results will be shared with customers once complete
- Public status/uptime page — not yet published
If a certification, audit, or pentest result is something your organization needs before signing a contract, reach out — we're happy to discuss our timeline directly.
Found a security issue?
We take reports seriously and will respond promptly.
security@mylittleworld.ca →