Security

Organizations trust McCoy with their learners' data. We collect only what we need to deliver learning, and we protect it with strong, layered controls across all our services.

Black and white photo taken through a powerful lens showing a part of a vehicle's grille and a tire.

Infrastructure

  • Hosted with a leading cloud provider in the United States, using fully managed services.

  • All customer data is stored in the United States.

Encryption

  • All data is encrypted in transit with TLS 1.2 or higher.

  • All data, including backups, is encrypted at rest with AES-256.

Access & authentication

  • Passwordless sign-in. Learners and administrators sign in with single-use, time-limited codes, so there are no passwords to steal or reuse.

  • Single sign-on. SAML 2.0 or OIDC single sign-on with your identity provider can be set up on request.

  • Role-based access. Permissions are scoped to each organization, and administrators manage their own users.

  • Least privilege. Access to production systems is limited to a small number of authorized McCoy personnel, and multi-factor authentication is enforced on every McCoy administrative account.

Tenant isolation

Each organization's data is logically isolated, and every request is scoped to a single organization.

Data privacy

  • We never sell data, never use it for advertising, and use no third-party tracking.

  • Customers own their data. At the end of a contract, data is returned on request and then deleted.

  • For schools and universities, McCoy acts as a FERPA "school official" and will sign the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement or the institution's own data privacy agreement.

Artificial intelligence

  • Learner data is never sent to any AI provider.

  • Our AI providers are contractually prohibited from training their models on our data.

Backups & availability

  • Automated daily encrypted backups, stored separately within the United States.

  • Updates are deployed without downtime.

Monitoring

Errors and infrastructure changes are monitored and logged, and logs are access-restricted.

Incident notification

If a security incident affects a customer's data, we will notify the customer without undue delay and work with them on any required notifications.

Compliance & assurance

  • Our hosting provider maintains SOC 2 Type II and ISO 27001 certifications.

  • We are building toward our own SOC 2 report and independent penetration testing.

Security reviews

We support customer security and procurement reviews. A HECVAT, VPAT and data privacy agreement are available on request.

Contact

For security, privacy or procurement questions, or to report a vulnerability, email support@mccoy.org.

Contact us for further security support

If your organization requires heightened security protocols, custom controls, or restricted deployment environments (e.g., defense or government use cases), please contact us to coordinate a tailored security review.