One workspace per school
Every record carries the school it belongs to, and every query is scoped to the signed-in user’s school before it runs. There is no screen, report or search in the product that can return another school’s learners.
Security, backups and data ownership
A school system holds children’s records and the school’s money. You are entitled to know how it is separated, who can reach it, what is written down and what happens if we disappear. Here is all of it, including the parts that are not finished.
The controls
These are implemented and running, not planned. You can verify most of them from inside the demo — try reaching a record your persona should not see.
Every record carries the school it belongs to, and every query is scoped to the signed-in user’s school before it runs. There is no screen, report or search in the product that can return another school’s learners.
Seven roles — principal, deputy, teacher, staff, parent, student and platform management — each with their own permissions. Teachers see the classes they teach. Parents see only the learners linked to them. Management accounts cannot sign in to a school workspace at all.
Every change request is written to an audit log with the account that made it, what was called, the outcome and the time. Approvals, mark changes and payment entries additionally keep their own record history.
Passwords are stored as bcrypt hashes, never in readable form. Sessions expire and can be invalidated school-wide. Sign-in and recovery are rate limited per account. Management accounts must enrol an authenticator app; school accounts can opt in.
M-Pesa and card payments are confirmed by our server against the provider before a learner’s balance changes, and provider callbacks are signature-checked and processed once only. We never see or store card numbers — the provider handles those.
The database is backed up daily on a schedule with a documented retention window, and encrypted offsite copies can be enabled for your deployment. Ask us for the schedule and the restore procedure before you sign — we will send both.
The strongest protection against choosing the wrong vendor is being able to leave with everything. We would rather win the renewal than trap you into it.
Read the privacy noticeYour learners, staff, marks and fee ledger belong to your school. We process them to run the service you are paying for and for nothing else.
No advertising, no data broking, no training third-party products on your school’s records.
Learners, staff, fees and results export on demand from inside the product — not by raising a ticket and waiting.
Export before you go and you keep everything. We do not hold records hostage to a renewal.
Said up front
Any vendor can list controls. The useful question is what they leave out — so here is ours, in writing, before you ask.
A managed PostgreSQL database and a dedicated API service. We will name the regions and providers for your deployment on request.
Support access is limited to the people who operate the service, and administrative actions are logged like any other.
API keys are read-only and cannot touch identity, settings or billing endpoints. You create and revoke them yourself.
Your next school chapter
Tell us what your team needs. We’ll agree on the right plan and setup before creating your login.