This page summarizes how Pearl Education protects customer and student data against loss and how we work to keep the Products available through disruptions. It is a plain-English overview for district and SEA evaluators, not the full internal plan.

Hosting and Redundancy

• Cloud hosting in the United States. All Pearl data is hosted in Amazon Web Services (AWS) US regions only. Pearl does not host customer data outside the United States.
• Primary and disaster-recovery regions. Pearl’s primary region is AWS us-east-1, with us-west-1designated as the disaster-recovery target region. Pearl relies on AWS managed data services that support cross-region disaster recovery.

Backups and Encryption

• Encryption. Customer Content is encrypted in transit and at rest as part of Pearl’s written information security program (MSA §4.3).
• Backups. Pearl uses AWS-native backup mechanisms, including nightly automated Amazon Aurora database snapshots with point-in-time recovery (PITR), point-in-time recovery for DynamoDB, and versioning for data stored in Amazon S3.
• Disaster-recovery backups. Disaster-recovery backup copies are retained only in encrypted backups, are not used for any purpose other than disaster recovery, and are automatically overwritten on a rolling schedule not to exceed seven (7) days (MSA §4.6; DPA Art. VIII, §8.3).

Recovery Objectives (RTO / RPO)

Two common measures describe recovery capability:

• Recovery Time Objective (RTO) — the target time to restore service after a disruption. Pearl’s platform RTO target is approximately six (6) hours.
• Recovery Point Objective (RPO) — the target maximum amount of recent data that could be lost, measured back from the point of disruption. Pearl’s point-in-time recovery and nightly snapshots are designed to keep potential data loss low.

Testing and Review

Pearl maintains continuity and disaster-recovery procedures and plans to validate them through a disaster-recovery tabletop exercise scheduled for Q3 2026. This exercise has not yet been performed, so Pearl does not represent that full disaster-recovery testing is complete.

Data Return and Deletion After an Event

Business continuity is related to, but separate from, end-of-contract data handling. On termination, customers can export Customer Content during the Service Period and for 30 days afterward, and Pearl deletes Customer Content no later than 60 days after that export period (or within 60 days of an earlier deletion request), with written certification on request (MSA §4.6; DPA Art. VIII). De-identified Data is excluded from these deletion obligations.

Related Pages

For live operational status and how availability commitments are made, see Status and Reliability. For breach notification timelines and Pearl’s security program, see the Security pages.