Cybersecurity Policy

Last updated: August 2026

Introduction

Mentor & Match is a virtual mentoring platform designed for community colleges, connecting students with experienced mentors — professionals from the local community, alumni, administrators, classified professionals and faculty — who provide academic advice, career guidance and personal development support.

Cloud security

• Our software solutions are hosted on the Microsoft Azure public cloud
• We provide SaaS solutions for higher-education institutions, including web and mobile applications hosted on Azure

Access control

• Access policies are reviewed annually or upon any environmental change
• Individual and school group accounts are created for institution staff and students; guest or temporary accounts are not supported
• Company personnel accounts are managed separately through Azure Active Directory, with a dedicated administrative application used to set up separate tenants and designated school administrator access per customer
• Source code is stored in Atlassian Bitbucket with limited access, and DevOps CI/CD pipelines deliver code automatically to production and staging; no personnel have direct access to data or code in the production environment
• Access is revoked as soon as IT is notified by a user's manager, project lead, or the Customer Success team
• Data in transit between web and API servers and clients is secured via SSL/TLS, and sessions are logged out after 30 minutes of inactivity, requiring re-authentication
• Azure Active Directory and Azure access-control services restrict access to Azure resources to Azure administrators, who assign limited, time-bound access based on least-privilege principles; customers oversee their own customer and user data and are notified if inappropriate access occurs
• Password requirements are enforced (minimum six characters, including one uppercase letter, one special character and one number), with account lockout processes being implemented

Awareness and training

• An Information and Security Awareness Training policy is implemented as part of onboarding
• Employees sign a completion/acknowledgement form retained in their Human Resources record
• All personnel sign individual non-disclosure and confidentiality agreements

Audit and control

• User accounts are audited quarterly
• Third-party tools test our Azure-hosted solutions against best practices and guidance
• Audit results are available to users upon request, and audit records are retained in a centralized log management system in accordance with our record-retention policies
• Azure resource health reports and annual risk assessment reviews are available upon request

Configuration management

• Atlassian Jira is used to track and prioritize all issues, bugs and enhancement requests; customers report issues to the Customer Success team and are notified once resolved, along with any applicable user training
• Application updates are delivered through APIs into the production environment
• Access follows the principle of least privilege; only authorized personnel may access or install pre-authorized software in our environment

Contingency planning

Our infrastructure uses Azure zone redundancy across data centers in the Eastern United States, designed to recover in an orderly and timely manner. Each college's data is held in a separate tenancy.

Identification and authentication

• Management determines access and authorization requirements for employees, contractors, business partners and suppliers; tenant customers manage their own user access
• Access must be authorized before any use of the application, and access policies are reviewed and updated annually
• We are implementing Okta for multi-factor authentication (MFA) and single sign-on (SSO); an IT system administrator can manually unlock accounts when necessary

System and communications protection

Microsoft Azure manages encryption across our databases. Production data is separated from non-production environments and is accessible only via API calls from the web or mobile application. Only authorized C-level personnel have access to the production database.

Security framework

To manage cybersecurity risk and protect critical assets, Mentor & Match has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework as our information security policy.

Incident response

We are developing formal security incident response plans tailored to our multi-tenant cloud environment, with customized requirements anticipated for each customer. Security incidents are monitored and quantified to proactively mitigate trends, and statistical incident data is shared with tenants upon request. Because tenant data is separated by tenant, only the relevant tenant's data would be produced in response to a legal subpoena or request.

Reporting a vulnerability

Report suspected vulnerabilities to info@mentorandmatch.com or call (877) 211-8504. We acknowledge reports within one business day and do not pursue action against good-faith researchers.