Data Security & Privacy Posture

Our approach

ASL Connection serves three groups whose information deserves real protection: the districts and organizations we work with, the Deaf and hard-of-hearing consumers we serve, and the interpreters we dispatch. The controls described below are implemented in our production platform today.

How access is controlled

• Least-privilege by default. Every record is protected by row-level security enforced at the database, so each person — client contact, interpreter, or administrator — reaches only the data their role requires. Access is scoped at the data layer, so it holds even if a page or link is shared.
• Administrator actions are gated server-side. Sensitive operations — sending agreements, issuing invoices, dispatching interpreters, viewing banking details — require verified administrator identity checked on the server for every request.
• Client and consumer data is isolated. One organization's requests, contacts, and documents are reachable only by that organization's authorized contacts and our administrators. Cross-organization access is closed by design.

How sensitive data is protected

• Banking credentials are encrypted at rest using a dedicated secrets vault, held separately from the rest of the record.
• Uploaded documents — agendas, prep materials — are stored in access-controlled buckets scoped to your organization, reachable only through authenticated, time-limited links.
• All traffic is encrypted in transit over TLS, and application secrets are held server-side and never exposed to the browser.

How access is recorded

• Tamper-proof audit trail. Sensitive actions — including every time an administrator views an interpreter's full banking details — are written to an append-only log that no one, administrators included, can alter or delete. If a question ever arises about who accessed what, there is a reliable record.
• Request lifecycle is tracked end to end, giving both our team and your contacts a clear, current view of each assignment's status.

Breach readiness

• A written incident-response plan governs how we contain, assess, and report a security event, aligned to Washington's data-breach notification law (RCW 19.255), which requires notice to affected residents within 30 days of discovery.
• Insurance is in force — commercial general liability, excess liability, and professional liability, including a privacy breach and regulatory defense endorsement. A certificate naming your organization as an additional insured is available on request.
• Recovery is planned, with database backups and a documented restore process so service and records can be recovered.

Alignment with district requirements

• Background-check ready. Interpreters working with students complete a fingerprint background record check through the Washington State Patrol and FBI, processed by OSPI under RCW 28A.400.303. Results are recorded in OSPI's Educational Data System, which your district can verify directly.
• Student-data aware. K-12 assignments can involve education records subject to FERPA. We handle assignment information on a need-to-know basis with data minimization in mind.
• Certified professionals. We dispatch nationally certified interpreters and hold professional credentials (RID) at the agency level.

Data practices

• We collect only the information needed to schedule, dispatch, invoice, and pay for interpreting services.
• We share assignment details with an interpreter only to the extent needed to perform the assignment.
• We do not sell personal information.
• Our full privacy policy and terms are published at privacy.html and terms.html.