Security & Data Protection

Last updated November 8, 2026

Child care records are sensitive. This page is a plain-language summary for directors, owners, boards and licensing specialists of how CenterDirector protects the information your program stores. Our Privacy Policy and Terms of Service remain the governing documents.

Encryption

• In transit: every connection between your phone or computer and CenterDirector uses HTTPS (TLS).
• At rest: your records are stored in a managed database that is encrypted at rest with AES-256, including its backups.

Who can see your records

• Each account’s records — staff and provider files, child files, attendance, care logs, medications, drills and inspections — are protected by database rules that only let the account owner read or change them. Other CenterDirector customers cannot see your records.
• A small number of CenterDirector administrators can access information when needed to operate, secure or support the Service, or to meet legal obligations. Administrator permissions are kept in a separate protected list that users cannot change from their own profile.
• We do not sell your records, and the Service does not run third-party advertising or remarketing trackers.

Signing in

• Sign in with an email and password (at least 8 characters) or with your Google account.
• Email accounts must confirm their address before first sign-in, and password-reset links are single-purpose and expire.
• Passwords are handled by our authentication provider and are not stored in readable form.

AI tools and your records

• The co-pilot and policy tools send what you type or upload, with your license type and relevant Delaware regulation excerpts, to AI providers to generate an answer.
• Your staff, child, attendance and medication records are not sent to AI providers by these tools unless you include them in what you submit.
• Please don’t paste identifiable child information, health records or passwords into AI questions or uploads.

Usage analytics

We record first-party usage events — such as which pages are viewed and which features are used — in our own database to improve the product. They are linked to your account when you are signed in, never include the contents of your records, are readable only by our administrators, and are not recorded when your browser sends a “Do Not Track” signal. We do not use advertising or tracking cookies.

Regulatory content

Official Delaware sources are monitored daily. When a rule changes, a person reviews it before it updates your checklists, and past inspection walkthroughs keep the checklist they were completed with. See the homepage FAQ for how AI research, citations and stored calculations fit together.

Payments

Automated payment collection is not currently enabled, and CenterDirector does not collect payment card details.

Backups, retention and deletion

• Encrypted backups support disaster recovery and roll off automatically on standard operating cycles.
• To close your account and delete its records, email support from your account address. We verify your identity and authority, record the request, then remove the account’s records from the active database. Individual records are not removed from existing backups before they roll off.
• Keep independent copies of records you are legally required to retain. Print views are available for logs, rosters and inspection reports.

What we don’t claim

CenterDirector does not currently hold a third-party security certification such as SOC 2. No system can guarantee complete security or uninterrupted availability, and nothing on this page is a guarantee of licensing compliance.

Report a security concern

If you believe your account or someone else’s information has been accessed without permission, email support@centerdirector.com right away. Please don’t include passwords or children’s details in the email.