Security and privacy
Every pickup rests on adults approved in advance, a pickup code from their own phone when they use the app, a match to their approved photo or a photo ID, a permission check at the moment of release, and an instant alert to the family. Sensitive records are encrypted with a key of their own.
What holds on every release
However someone is collected, these hold every time. The code proves possession, the photo proves identity, and the server proves authorization.
1. They were on the record first. Your organization records who may collect each person, each with their own dates and permissions: a grandparent can be approved for pickup without reading anything else. A guardian can ask to add someone, which an administrator approves, or give another adult a pass for a single day, which the other guardians and the staff who release are told about the moment it is made. Nobody else is on the list.
2. With the app, they hold the pickup credential. An adult with Assure presents the code from their own phone, issued to their account for this one pickup. The code proves possession of that credential; on its own it does not prove who is holding the phone.
3. They are who the credential says. Before Release unlocks, staff match the adult to their approved photo, with their name and relationship on screen. No approved photo on file means a photo ID that must show the full name on record. An adult on a day pass has no app and so no code, so their photo ID carries the check.
4. Permission held at the moment of release. Authorization is re-checked the instant staff release someone, not when the pickup was requested. A custody change entered at noon stops a 3pm pickup, even if the parent is already in the car line.
5. The family was told, immediately. Every release alerts each adult on the record who follows pickups in Assure, including the one who collected, so a hijacked account is noticed by its real owner: “Ava was released to Jordan M. at Riverview Academy at 3:09 PM. Not expected? Call Riverview Academy now.” The alert is written in the same database transaction as the release itself, so a release can never happen without its alert queued to send. It names the time of the release, so even an alert held up in delivery says exactly when it happened.
How each adult is checked
| Who is collecting | Credential | Identity |
|---|---|---|
| An adult with Assure and an approved photo | The rotating code from their phone | A match to their approved photo |
| An adult with Assure, no approved photo yet | The rotating code from their phone | A photo ID |
| Someone on a guardian’s day pass | None; they have no app | A photo ID showing the full name the guardian gave |
| An adult whose code is unavailable | A staff override with a written reason | A photo ID |
The server re-checks authorization on every one of these paths.
The pickup code
The code proves the adult holds the credential for this pickup. It is issued to their own signed-in account, only for this pickup and only once it is ready, so a code for the car behind is refused. It changes every minute and works once. A copied code still cannot release anyone, because staff match the person to their approved photo or a photo ID.
The app blocks screenshots of it, the account holder is told when it is opened, and it keeps working in a parking lot with no signal. Wrong guesses are limited, and when they pile up at a location, administrators are told.
Photos
The approved photo is how staff confirm the person holding the code is the adult it belongs to, so a routine pickup does not need a driver’s license every day. Photos are approved by the organization. A family member can submit their own from the app, but staff never see it until an administrator approves it, and every device on the account is alerted the moment one is submitted, so a stranger who got into the account cannot put their own face on it. Photos are stripped of location data, encrypted, and only ever shown through links that expire.
Scanning the right car
The QR on the family’s phone carries the pickup it belongs to, so scanning it at the wrong car is refused: on the staff phone, by name (“That code is for Mason Lee’s pickup, not this one”).
When there is no code
A dead phone should not strand anyone. Staff can release an adult whose code is unavailable, but only after checking a photo ID and entering a written reason, recorded against their name. Authorization is still re-checked, the family is still alerted, and the release appears in the exception report.
Data protection
Per-record encryption. Note text, adult photos and every pickup secret are sealed with a key generated for that record, itself wrapped by AWS KMS. Outside development, the service refuses to start without KMS.
Least privilege by role. Staff working the pickup line can release someone but cannot change who is allowed to collect them. That separation is enforced in the API, not just hidden in the interface.
Permissions take effect on the next request. What a person may do is read from the database on every request, never carried in their sign-in token, so a revoked staff account or a withdrawn authorization stops working at once rather than when a token expires.
Sessions. Access lasts fifteen minutes and renews automatically. A renewal token works once, so a stolen one is detected the moment it is reused, and every session on that account is signed out. On phones, tokens are kept in the device’s secure keychain.
What is auditable
Every pickup carries a trail that InzuCare only ever adds to: every status change, every code issued, every code presented including the rejected ones, every identity confirmation, and every override with its reason and its author. Families can read the trail and pickup record for their own pickups.
Revoked authorizations and pickup requests are never deleted, so “who was allowed to collect this person on the fourteenth” stays answerable.
Support access is separately audited. When InzuCare staff open a session inside your organization it is time-boxed to fifteen minutes, requires a written reason, and is written to an audit log before the session opens.
Compliance posture
InzuCare is designed with FERPA and HIPAA obligations in mind: access is scoped per person and per category, and retention favors preservation over deletion, because custody and billing records are expected to outlive the systems that created them.