Security & data residency

Last updated September 2026

In one sentence

DailyDotKids is for licensed centres in Canada and the USA. Production daycare records are stored in Canada today on Google Cloud, isolated per centre, encrypted in transit and (for sensitive fields) at rest, and accessible only to people your centre invites — we do not sell personal information.

Where production data lives

Canada region: Centre database records, classroom photos, and vault files are hosted in Google Cloud northamerica-northeast1 (Montréal, Québec) — including for centres in the USA, until we offer additional regional hosting.
Markets we serve: Licensed child care centres in Canada and the USA. Your local licensing rules still apply in your province, territory, or state.
In-country direction: Our longer-term approach is to keep operational daycare data local to the country of the centres we serve. Today, production hosting is the Canada region for everyone on DailyDotKids.
Workloads in that region: App Engine (API), Cloud SQL (database), Cloud Storage (photos and vault files), and Secret Manager (runtime secrets). Company: Anthor Canada corp, Langley, British Columbia.

Push notifications and some email delivery may use global networks so a message can reach a phone or inbox. That is for delivery only — centre records in our database and file storage remain in the Canada region above. See Subprocessors.

Who can access centre data

Scoped by daycare: Admins, teachers, and parents only see data for centres they are invited to.
Role-based: Owners/admins manage roster and settings; teachers run the classroom day; parents see their own children.
Anthor staff: Production access is limited to people who need it to run or support the service, under least privilege.

How we protect data

HTTPS for app and API traffic.
Encryption at rest for sensitive fields (for example allergies, dates of birth, emergency contacts, activity notes, vault document metadata) and encrypted vault files — see our Privacy Policy.
Hashed credentials: passwords and PINs are one-way hashed; we cannot read them back.
Secrets: runtime credentials are stored in Google Secret Manager, not in public source control.
Managed infrastructure: Google Cloud operates the underlying physical security, patching, and regional controls for the services we use.

What we do not claim

We do not claim SOC 2, ISO 27001, or HIPAA certification at this time.
We do not replace your duties as a licensed child care operator — see Compliance.
No system is perfect. We focus on practical controls, honest documentation, and clear contact paths when something goes wrong.

Contact