Security Overview
Technical and organisational measures we use to protect school and student data.
Encryption in Transit
All data is transmitted over HTTPS using TLS encryption. No data is sent over unencrypted channels.
School Data Isolation
Tenant-scoped records carry a school identifier and are protected by row-level security. Access rules combine school scope with user identity, role and, where applicable, assigned-supervisor ownership.
Role-based Access Control
School-facing roles include student, supervisor, coordinator, librarian and school administrator. A separate platform-superuser role is reserved for platform administration. Authorization is scoped by role and tenant.
Audit Logging
Security-sensitive administrative actions are recorded in the platform audit log. Additional operational logging is provided by the hosting platform; the exact metadata available depends on the event and infrastructure layer.
Authentication & Sessions
All non-public pages require authentication. Authentication is handled by Base44's managed authentication service. Application routes require authenticated access where appropriate, and role/tenant authorization is additionally enforced in the data layer.
Managed Cloud Hosting
The platform is hosted on Base44 managed cloud infrastructure. Our Base44 applications have been migrated to the UK data region, with completion confirmed by Base44 Support. Base44 states that it is SOC 2 Type II and ISO 27001 certified and uses TLS 1.2+ in transit and AES-256 at rest.
Breach Notification
In the event of a data breach that affects school or student data, we will notify the affected school without undue delay so the school can assess and meet its own notification obligations under applicable data-protection law. Notification will include a description of the nature of the breach, the categories of data affected, likely consequences, and measures taken or proposed to address the breach.
Schools may be required to notify their supervisory authority (e.g. the ICO in the UK) and/or affected individuals depending on the nature and risk of the breach. We will provide all reasonable assistance in fulfilling these obligations.