Security & Governance

Secure, governed, and role-aware by design.

Protect student and financial data with controls that scale from single schools to growing networks.

Governance operators can demonstrate

Role matrices, audit trails, MFA discipline, and tenant boundaries—so security reviews start with evidence, not slogans.

In the product
Records stay with their school
Every query on school data has to name its school. A scanner in the release checks fails when one does not.
In the product
Role-based permissions
Sensitive actions check a named permission. A scanner in the release checks fails when code names a permission that does not exist.
In the product
Audit trails without secrets
An audit record keeps which field changed, by whom, and when. Passwords, tokens, and a student's most sensitive values are left out.
In the product
A tamper-evident log for migrations
Migration events are chained by hash, and a verifier reports the first broken link.
In the product
Secrets stored encrypted
Webhook signing secrets and imported legacy password hashes are stored encrypted.
In the product
Separation of duties
On erasure, export, and correction requests, whoever asks never approves, and whoever approves never carries it out.

We never imply SOC 2, PCI, or live payment settlement until externally verified and published for your deployment.

Not published
SOC 2 Type II

Control design documented; external attestation not published
Not published
ISO 27001

Control design documented; external attestation not published
Not published
PCI DSS attestation

Control design documented; external attestation not published
Not published
Live PSP settlement

Control design documented; external attestation not published

Replace casual sharing and opaque admin history with least-privilege access and meaningful logs.