Built like the records it keeps matter — because they do.

Every connection to SproutComm — a parent's phone, an advocate's browser — runs over TLS encryption. Nothing travels in the clear.

Staff sign in to their own workspace. Each family reaches only its own thread, through a private per-family link — no passwords for parents to manage, reuse, or lose, and no way to wander into another family's conversation.

Every message, reply, and confirmation is timestamped and attributable the moment it happens. That completeness is the security posture: a record that documents itself cannot quietly lose the parts that matter — which is also exactly what §1302.50 asks a program to prove.

All intelligence runs server-side. A parent's phone only displays text, plays audio, and records voice — it holds no model and makes no decisions. Family content is processed only by Meta's first-party Muse models; it is never routed to third-party contributor models.

Plenty of families live with unreliable connections. Confirmations and voice notes queue safely on the phone and send when service returns — a dead zone delays the record, it never erases it.

The public demo runs entirely on synthetic data. Pilot data stays in the pilot, separated from anything public — the two never mix.