For the person who has to approve it
Isolation is mechanical, not careful. Every row of every table carries the school it belongs to, and a restrictive database policy no query can talk its way around decides what a session may read.
On top of that sit ordinary permissions: per module (a fundraiser sees donations and no tuition), per field (salaries and medical notes are separate from the screens that show them), per record (a teacher scoped to their own department), and a full audit trail with who, when and what it was before. Deleted records go to a 30-day trash, and the whole system can be rolled back to any instant.
For the office
What a secretary, a bursar or a head of year can do with it.
- Give a volunteer exactly one screen, and take it back the day they leave
- See who looked at what, and undo any change
- A 30-day trash, so a deletion is never the end of the story
For whoever has to approve it
Where the data sits, who can read it, and what it connects to.
- PostgreSQL row-level security with a restrictive tenant policy on every table, verified by an automated check that fails the build if a table is missed
- Foreign keys carry the tenant, so a row cannot reference another school's row even through a bug
- Module, field and record-level permissions; department scoping; a complete audit log
- EU hosting, encrypted nightly backups with off-site copies, and a signed DPA
- Support access to a school needs a written reason, expires within hours, and is logged either way
- Full data export and erasure on request; your data is yours to take
Questions we are asked
- Where is the data hosted?
- In the EU, with backups encrypted and also kept in the EU.
- Can your staff see our data?
- Only with a grant that names a reason, expires within four hours, and is written to an access log you can read.
- What happens if we leave?
- You take a full export. There is no lock-in and no export fee.
See it with your own school's data
Sixty days free, no card up front — or open a ready-made demo school and click around it first.