Pearl Education maintains processes to detect, respond to, and notify customers about security incidents affecting Customer Content, including Student Data. This page explains our notification commitments and how to report a suspected incident.

Our Notification Commitment

Pearl will notify the affected customer without undue delay, and in any event within seventy-two (72) hours of confirming, a breach of security leading to unauthorized access to or disclosure of unencrypted Customer Content (MSA §4.5). For incidents affecting Student Data, the same without-undue-delay and within-72-hours-of-confirmation commitment applies (DPA §7.1).

What Our Notice Includes

To the extent known at the time, our notice will describe the nature and scope of the incident; the categories and approximate number of affected records; the dates of occurrence and discovery; the mitigation steps taken; and a Pearl contact (DPA §7.1). Pearl will supplement the notice within five (5) business days as additional information becomes available (DPA §7.1).

Cooperation and Cost

Pearl will provide the information customers reasonably need to meet their own legal notification obligations, cooperate in the investigation, and take reasonable steps to mitigate harm and prevent recurrence (MSA §4.5; DPA §7.2). Where notification to individuals or regulators is legally required and the incident was not caused in whole or in part by the customer, Pearl will bear the reasonable, documented costs of those required notifications (MSA §4.5; DPA §7.2).

Post-Incident Review

Following resolution of a material incident, Pearl will provide a written incident summary and, on request, participate in a post-incident review with the customer (DPA §7.3).

How to Report a Suspected Incident

If you believe you have discovered a security incident, unauthorized access, or suspicious activity involving Pearl or Customer Content, contact our security team immediately at seccom@poweredbypearl.com (MSA §3.1). Customers should also notify Pearl promptly of any unauthorized access on their side (MSA §3.1; DPA §3.2).