Enterprise Security. Built for Families and Schools.

At QDrop, we believe parent-school communication should be effortless, secure, and entirely private. We apply the same bank-grade security standards trusted by major enterprise companies to protect your school community's data.

21972-312_SOC_NonCPA
GDPR
iso-27001
Parent-student-security

Helpful Links

Explore our live compliance status, review our standard agreements, or request access to gated security reports.

View Trust Center
Security & Compliance Reports

SOC 2 TYPE II Report

Penetration Test Report

Subprocessor Directory

Legal Agreements

Privacy & Security by Design

We keep things simple and transparent. Here is how we protect your school district:

1. Zero Direct Student Data Collection

Students do not log in to or directly use QDrop. Our platform is designed strictly for parent-school administration and communication. We do not build independent profiles on students or track children online

2. Enterprise-Grade Security (SOC 2 Compliant)

QDrop maintains SOC 2 Type II compliance, verifying that our technical controls, encryption, and operational practices meet rigorous independent security audits. We are currently completing our ISO 27001 certification to further strengthen our international security posture.

3. Data Localization (Your Data Stays Home)

We respect regional data sovereignty. Core application and school communication data for UK institutions stays on secure servers in the United Kingdom, Canadian data stays in Canada, and US data remains in the United States.

4. Your Data Belongs to You—Always

We never sell customer data, we never serve targeted advertisements, and we never train AI models on your school's private messages or documents. You own 100% of your data.

Built to Meet Global & Local Standards

Navigating privacy laws shouldn't stall school communication. QDrop is architected to comply with privacy regulations across our core markets:

  • United Kingdom (UK GDPR & ICO): Complies with the Data Protection Act 2018 and includes the ICO International Data Transfer Addendum (UK IDTA) for secure identity authentication.

  • Canada (PIPEDA & Quebec Law 25): Fully aligned with federal PIPEDA rules, provincial PIPA acts, and Quebec Law 25 requirements (including localized Canadian server hosting and Privacy Impact Assessment support).

  • United States (FERPA & COPPA): Designated as a "School Official" under FERPA, with full COPPA alignment and support for state-level student data privacy agreements (NDPAs).