# CodeQuest Kids — Security & Child Safety Launch Gate

Required before public launch:
- Parent/guardian account creation and verifiable consent flow
- Child accounts separated from parent controls
- Data minimisation, retention and deletion controls
- Rate limiting and abuse monitoring on all AI endpoints
- Server-side AI key storage only
- Isolated server-side code execution; never execute arbitrary child code inside the primary Worker process
- Payment provider configured with verified webhooks; no card data stored by CodeQuest Kids
- Privacy notice, terms and child-safety reporting process published
- Accessibility and supervised child-safety QA completed
- Backups and incident-response process tested