Runs inside your network. Tokenized at the edge.
Heronix products don't require cloud connectivity to operate. They run on your infrastructure. Student PII is designed to be tokenized at the network boundary before any external integration receives data. No vendor can flip a switch and expose your district's records.
The security posture
On-premise by default
Products are designed to run entirely inside the district network. No required outbound cloud connectivity for core operation. Kiosks and classroom tools are offline-first and reconcile when reachable.
Guardian tokenization
External integrations route through Guardian, a dedicated gateway application that tokenizes student PII before any data leaves the district. Each external vendor will receive a unique, non-reversible token namespace. A breach at one vendor cannot reconstruct the district's roster.
No vendor-held master keys
The tokenization master key is designed to never leave district infrastructure. Heronix does not hold a copy. A vendor breach at Heronix would not expose tokenized data at districts running Heronix.
Auditable locally
Guardian is designed to log every integration that receives data, which fields, for which tokens, and when. Logs stay on district infrastructure, no telemetry pipeline to a vendor's cloud.
Authentication under your control
Accounts live on your servers: Argon2id password hashing, TOTP multi-factor authentication, and role-based access control. Heronix Browser can additionally broker sign-in from Google or Microsoft Entra. Heronix does not require a separate user directory it controls.
No silent updates
Software updates are available; applying them is a district decision. No forced background upgrades that can change behavior mid-semester. You control the patch cycle.
What we hand to your team
- Deployment guide for on-premise installation
- Network boundary diagram, where tokenization happens
- Threat model document, what Guardian does and does not protect against
- Data flow diagram for every external integration
- Audit log schema, what gets logged, retention options
Security teams get the documents before signing anything. Bring your most adversarial threat model.
Request a technical call
We'll walk your IT and security team through the tokenization boundary, master-key handling, and integration flows. 45 minutes, no sales ambush.
Request a call Read the architecture