Security
How Dojo Forge protects your school's student and family data, in plain English.
Encryption
Every connection to Dojo Forge, from your browser, the family portal, and our own services, is encrypted in transit with HTTPS (TLS). Your school's records are stored in a managed Postgres database (Neon) that encrypts data at rest, including its backups. Card details never touch our servers: payments run through Stripe. Connected email accounts' tokens are stored encrypted.
Who can see your school's data
Each school's records are kept to that school, and each family sees only its own children in the portal. Tarnished Labs is a small team, and we look at a school's data only to run the service, fix a problem, or answer a request from that school. We do not sell your data, use it for advertising, or share it with anyone except the service providers that run Dojo Forge for us (Stripe, Neon, Vercel, Google Workspace), who process it only on our behalf.
Children's records
Most martial arts schools teach kids, so Dojo Forge treats student records as sensitive. Accounts are for adults: school staff and parents or guardians. We do not collect information directly from children, and the records you keep about your students belong to your school, not to us.
Data retention
Your school's data is kept for as long as your account is active. If you cancel, export what you need first or ask us for a full export, and we will delete your school's data when you ask.
Export and deletion
Your data is yours to take with you. Attendance reports and waiver records export from inside the app, and we will send a full export of your school's records on request. To delete your school's data, email us from the account owner's address and we will confirm when it is done.
Compliance
Dojo Forge is a young product built by a small team, so we will be straight with you: we do not hold a SOC 2 or similar certification yet. We build on providers that do (Stripe is PCI DSS Level 1; Neon and Vercel hold SOC 2 Type II reports), follow our privacy policy, and honor access, correction, and deletion requests under laws such as the CCPA and GDPR.
Reporting a problem
Found a security issue, or worried about something you saw? Email niclock@tarnishedlabs.com. It goes straight to the person who builds Dojo Forge, and we will tell affected schools promptly if their data is ever exposed.