How we keep your school’s data safe.

Every school runs on its own isolated per-tenant database — not a shared table with a school-id column. One school can never read, query, or stumble into another school’s records, because the data physically lives apart.

Every payment posts to the books as it arrives, so the balance quoted to a parent is the balance the school actually has — and a term closes without anyone rebuilding it in a spreadsheet.

Every sensitive action is written to an audit log: who did what, when, with a before / after snapshot. The log is hash-chained, so any attempt to alter or delete a past record breaks the chain and is detectable.

Sensitive fields are protected with column-level (envelope) encryption at rest, and all traffic to the platform travels over TLS in transit. The most sensitive data is never stored in the clear.

Fine-grained, role-based permissions scope every user to exactly the org and school they belong to. Sensitive money moves pass through a staged approval engine — a maker proposes, a checker approves — so no single person can move funds unilaterally.

The school decides what its data is used for; we process it only on the school’s instructions, and never for advertising, profiling or training models. Where data is held, and which suppliers touch it, is set out in our Data Processing Agreement.

Payments run through M-Pesa via the official Safaricom Daraja API. We store no card numbers and no card data — there is simply no card surface to breach.

Each tenant database is backed up on a regular schedule, so a school’s records can be recovered — isolated, per school, the same way they are stored.

The school owns its data and remains the controller of it at every step. Our Privacy Policy sets out exactly what we process and why. Schools that need specific terms on file should talk to us — we would rather agree them with you than publish a template that does not fit your situation.