Data protection

Separation is enforced by the database itself, on every query, rather than by the application remembering to filter. A mistake in our code cannot show one school another school’s records.

CodeLytical Hub staff can administer a school — students, classes, results, timetables — but fees, invoices and payments are refused to us in code. We could not look at a school’s money if we wanted to.

When our staff open a school to help, it is written into that school’s own audit log, visible to the school. There is no way for us to look around unseen.

Hashed with argon2id and never stored in a form anyone can read — not by us, not by anyone who obtained the database. Sign-in sessions are revoked immediately when an account is suspended, rather than lingering until they expire.

A teacher sees their own classes. A bursar sees fees. An administrator sees the school. Parents see only their own children. Every screen checks this on the server, so a link shared by accident shows nothing to somebody without permission.

Schools are legally obliged to hold student records for years. Nothing we do — pausing an unpaid account, closing a dormant one — deletes them. A school reopening finds everything as it was.