Security and privacy
Shepherd holds information about children, so it collects only what filtering and teaching need, keeps it in the United States, and never sells it or uses it for advertising.
Connect Google Workspace
Shepherd will be able to read, not change:
- Read-onlyUsers and organisational units
- Read-onlyChromeOS devices
- Read-onlyClassroom courses and rosters
No access to Gmail, Drive, Calendar or files.
CancelContinue to Google
What we will not do
Schools trust a filter with the most sensitive record a child has: what they look for online. These lines don’t move.
- Sell student data, or share it with anyone for advertising.
- Ask Google for Gmail, Drive or anything beyond your directory and Classroom rosters, read-only.
- Ask students to sign in to Shepherd. The extension works from the Chromebook’s managed account.
- Mix your school’s data with another school’s. Every school is its own organisation on the platform.
- Put analytics, ads or trackers on this website. It sets no cookies.
What Shepherd collects, and why
| What | In detail | Why |
|---|---|---|
| Web activity from school Chromebooks | The address, time, account, device and whether it was allowed, blocked or flagged. | To filter, and for your reports and investigations. |
| Search terms and YouTube titles | The words searched on supported sites and the titles of videos opened. | For smart detect and the YouTube report. |
| Live screen images | A small, recent picture of each Chromebook screen, replaced as new ones arrive. | For the live classroom view. |
| Directory and rosters from Google | Names, email addresses, OUs, Chromebook inventory, classes and rosters, read-only. | To apply policies and show teachers their classes. |
| Staff sign-in | Name, email address and sign-in times for staff who use the console. | To sign staff in and keep the audit log. |
Your school owns its data. You can export it at any time, and when a contract ends we delete it on a written schedule. Retention periods for browsing history will be set out in the data processing agreement.
Where it lives, how it is kept
Shepherd runs on DigitalOcean in the United States. Every connection is encrypted in transit, and the database and backups are encrypted at rest.
- The database accepts connections only from Shepherd’s own servers, on a private network.
- Every request from a Chromebook is checked against your school’s verified domains.
- Google access is held as an encrypted token per school, and you can revoke it from Admin Console.
- Shepherd staff sign in with Google and two-step verification.
- Nightly backups, and a rebuild procedure we have tested.
Google Workspace
Connected- People612
- Organisational units38
- Chromebooks512
- Classroom classes24
Last sync 2 minutes ago · read-only
Audit log
Export CSV| When | Who | Event | Target | Details |
|---|---|---|---|---|
| 10:44 am | k.hart | Focus started | Science 7 · Period 3 | desmos.com, khanacademy.org · 45 min |
| 10:39 am | admin@hillside | Request approved | coolmathgames.com | For one student · D. Reyes |
| 10:12 am | admin@hillside | YouTube video blocked | Ultimate prank compilation 2026 | All policies |
| 9:55 am | j.mendez | Flag reviewed | Filter evasion · C. Nguyen | Spoke with student |
| 8:02 am | admin@hillside | Policy edited | Middle School · Class time | Blocked: AI chat |
Your school’s data
Settings- Browsing historyExport CSV
- Flags and reviewsExport CSV
- Policies, rules and schedulesExport JSON
- Audit logExport CSV
Outside services we use
Shepherd relies on five other companies, each for one job. We will tell schools before adding another.
| Service | What it does for Shepherd | Data it handles | Where |
|---|---|---|---|
| DigitalOcean | Hosting, database and backups | All service data | United States |
| Staff sign-in, and reading your directory and Classroom rosters | Directory and roster data, read-only | United States | |
| Cloudflare | DNS, TLS and delivery of this website and the service’s web traffic | Traffic in transit | Global network |
| Resend | Email we send: alerts, access requests, sign-in and account notices | Recipient addresses and message contents | United States |
| Stripe | Invoices and payments | Billing contacts and payment details; no student data | United States |
Agreements for your board
We sign a data processing agreement with every school. Ask for ours, or send us the one your school or state uses. Our privacy policy, terms and DPA outline are drafts under legal review.
To report a security problem, write to [email protected]. We read every report and will reply to you.
Start with thirty days
We set up a monitoring-only pilot beside your current filter, free for thirty days. Nothing changes for students until you turn filtering on.
Start a 30-day pilot