Security at Wylari

Last updated: August 10, 2026

Daycare providers trust Wylari with information about children and families — we treat that as the most sensitive data a small business can hold. This page explains, in plain language, how it is protected.

Every daycare's data is isolated — in the database itself

Each provider's data is separated using PostgreSQL row-level security, enforced by the database engine on every query, not just by application code. Even a bug in the application cannot return one daycare's records to another: the database refuses. Inside the parent portal, access is further scoped to the signed-in family, the same way — a parent can only ever see their own children's information, enforced at the database layer.

Encryption & credentials

All traffic is encrypted in transit (HTTPS/TLS). Uploaded files — photos, documents, signatures — are mirrored to encrypted object storage.
Passwords are stored only as salted hashes, never in readable form.
Sign-in links, device tokens, and packet links are stored as one-way hashes — a copy of the database alone cannot be used to sign in or open a family's private link.
Private links (parent sign-in, enrollment packets) are single-purpose, expire, and stop working after use.

Access control

Owners can enable two-factor authentication (TOTP) with recovery codes and verified trusted devices.
Staff sign-in is device-bound: an emailed verification link trusts a specific device, and a PIN works only on that device — a staff PIN cannot be used from anywhere else.
Staff access is default-deny: employees see only the areas the owner has explicitly granted. Financials and platform settings are owner-only.
Check-in kiosks are enrolled devices with their own credentials, limited to check-in duties.

Health records & HIPAA — an honest answer

Providers store immunization records, allergy and medication notes, and scanned health forms in Wylari, so we get asked about HIPAA. Here is the straight answer: HIPAA does not apply to childcare records. HIPAA governs healthcare providers, insurers, and their vendors — "covered entities" in the law. A childcare program is not one. When a family hands their daycare an immunization record, that copy is legally a childcare record, the same as it would be in a paper file at the daycare. That's not a loophole we found; it's how the law is written, and it's why no daycare software can truthfully wear a "HIPAA compliant" badge for this data — be wary of any that does.

What matters is how the data is actually protected, so we treat health records as if the strictest rules did apply:

Encrypted in transit and at rest, like everything else in Wylari.
Isolated to the daycare — and, in the parent portal, to the child's own family — by the database engine itself.
Health documents uploaded by parents sit in a review queue until the provider has looked at them.
Every view of a scanned health document is recorded — the provider can see exactly who opened a child's record, and when.
Never sold, never used for advertising, never shared beyond the processors listed in our DPA.

Where data lives

Wylari runs on servers in the United States (Phoenix, Arizona), with uploaded files mirrored to encrypted object storage, also in the United States. The small set of service providers we use — and exactly what each one processes — is listed in our Data Processing Addendum. We do not sell personal information, and analytics never run on the check-in kiosk or the parent portal.

Payments

Wylari never touches card numbers. Subscription payments are handled entirely by our payment processor; tuition tracking inside Wylari is record-keeping only — no money moves through us.

If something goes wrong

If we become aware of a breach affecting a provider's data, we commit to notifying that provider without undue delay with what we know, so they can meet their own obligations to families — the same commitment written into our DPA.

Certifications. Wylari does not currently hold a SOC 2 or ISO 27001 attestation — audits sized for enterprises, not (yet) for software built for home daycares. The practices above are simply how the product is built. If your organization has a security questionnaire, we're glad to complete it: security@wylari.com.

Reporting a vulnerability

Found something? Please tell us at security@wylari.com. We read every report, we'll respond promptly, and we won't take action against good-faith research that respects families' data.