Data Security

Last updated: September 2026

FreshOut 360 holds case notes, intake documents, and personal information about people your organization serves. Protecting that data is a design requirement, not an afterthought. This page describes how we do it, in plain language.

Where your data lives

The platform and its data are hosted on enterprise cloud infrastructure in data centers located in the United States, with physical security, redundancy, and compliance certifications maintained by the hosting provider.

Encryption

Data is encrypted in transit using TLS and encrypted at rest using industry-standard AES-256 encryption. This applies to case records, documents, and backups alike.

Who can see what

Your administrator decides, person by person, which parts of the platform each teammate can open — Cases, Budget, Staff Development, Grants, Reports, and settings. Volunteers use a clock-in kiosk and never see client records. Every login is a named account. Every case note carries the name of the person who wrote it and cannot be edited once published, and deleting a client record is logged, so there is an audit trail. Within FreshOut Education, access to customer data is limited to the small number of staff who need it to provide support, and every read or write of customer data by our staff is logged.

Backups

The database is backed up automatically every day and every week, backups are kept for up to 90 days, and the database can be rewound to any point in the past 7 days. Uploaded documents keep prior versions for 90 days. All backups are encrypted. Backups exist so your data survives a failure or a mistake, not as a second copy for any other use.

You own your data

Your organization owns every record it enters. An administrator can download everything at any time from System Settings → Your data → Export everything: every record type as CSV and JSON, every uploaded document, and your settings, in one ZIP. If you leave FreshOut 360, we provide a complete export of your data within 30 days and permanently delete it from our production systems and backups within 90 days of your written request.

How Ask AI handles client data

Ask AI answers plain-language questions using only your own organization's data. It never sends client records to the AI provider — only counts and totals (for example, how many people were served this quarter). Client records are not shared with other organizations and are not used to train AI models.

If something goes wrong

We maintain an incident response process. If a security incident affects your organization's data, we will notify your administrators without undue delay, tell you what happened and what data was involved, and explain the steps we are taking.

Reporting a concern

If you believe you have found a security vulnerability, or have questions a funder or board is asking, contact us at 360@freshouteducation.org. We answer security questionnaires for current and prospective customers.