You're probably here because a vendor has burned you before — a missing BAA, a redacted SOC 2, a sub-processor change you found out about from a news headline. We've built this page so that doesn't happen with us.
Operations
Production telemetry and historical uptime are published continuously at our status page. The compliance program itself is managed through Scrut, our GRC platform — every control, every audit, every piece of evidence lives there and is independently verifiable.
Live verification
Most trust pages are static. Ours is connected directly to Scrut, the GRC platform that runs our compliance program. Every control, every piece of evidence, every audit artifact you'd want to verify — is verifiable in real time, not on a quarterly refresh.
Powered by Scrut Trust Vault
Behind every trust claim is an actual control with a status, an owner, an evidence file, and a last-tested date. The Trust Vault publishes that machine state directly — sourced from Scrut, the platform we use to run our compliance program day to day.
Procurement teams can verify the status of any framework, request access to evidence under NDA, and subscribe to alerts on changes. Your security team won't need to email us. The receipts are right there.
What's verifiable, live
Compliance
Pencil Spaces is audited or certified against eight regulatory and industry frameworks: FERPA, COPPA, SOC 2 Type II, GDPR, HIPAA, CCPA, ISO 27001, and SDPC NDPA. Each row below maps to a specific federal regulation, attestation, or industry standard. Reports are available on request, generally under mutual NDA.
Frequently asked
Procurement, IT, and parents tend to arrive with the same questions. The answers are below — short, sourced, and quotable. For anything not covered, the Trust team responds at trust@pencilspaces.com.
Coordinated disclosure
If you have found a vulnerability, write to security@pencilspaces.com. We acknowledge new reports within one business day, triage within five, and treat coordinated disclosure as a partnership — not a legal threat. Researchers acting in good faith have our full safe-harbor commitment.
Self-serve through the Trust Vault, or write to a real human.
