How SchoolEasy protects school and student data
A school trusts us with its children's records, its fees and its staff's salaries. Here is exactly how SchoolEasy keeps them safe today.
Who can see what
Access by job, not by password
Each staff member gets only the powers their job needs, chosen one by one by an administrator. Teachers, students and parents get what their role allows, and an administrator can switch parts off for a whole role.
Every request checked
Each school's records are kept apart, and every request is checked against the school and the person making it before anything is read or changed.
Learners see only their own
Students and parents reach only their own records and their own children's. Teachers see the students they teach.
Accounts and connections
Hashed passwords
Passwords are stored as one-way hashes. New school sign-ups and password resets are confirmed with a code sent by email.
Protected sign-in
Sign-in, sign-up and password reset are rate-limited and protected from bots, and a suspended account stops working at once.
Encrypted in transit
Every page and app connection uses HTTPS, through Cloudflare, and the servers accept traffic only from it.
Private file storage
Uploaded files are kept in private storage and reached through signed links that expire. Large photos are resized and their location data removed.
An activity log
On the paid plans, every change made in the school, every sign-in and every password reset is recorded in the activity log, kept for 90 days.
Data kept only as long as needed
Website admission applications are deleted automatically after the period the school chooses, and spam enquiries after 30 days.
AI that cannot do more than you can
Every action the AI assistant takes goes through the same checks as the browser, as the person who asked. It cannot see or change anything that person could not.
By default it shows each change before applying it. Deleting records, anything involving money and large batches always need a person's confirmation. The assistant is never available to students or parents. Their separate AI help, a tutor for students and Explain for families, stays off until the school turns it on, reads only what that student or parent can already see, and changes no school records.
- Conversations are kept for 90 days by default
- Teachers get the assistant only if the school allows it
- Completed actions are recorded with the person who approved them
What we never do
- Sell, rent or share student data with advertisers or data brokers
- Show advertisements to students, parents or staff
- Hold or route parents' fee payments: they go to the school's own account
- Give the AI assistant any access the signed-in person does not have
Frequently asked questions
Who owns the data a school puts into SchoolEasy?
The school. SchoolEasy processes it to run the school's account, and lists and documents export to CSV, Excel or PDF whenever the school wants them.
Can SchoolEasy staff see our records?
Access to a school's data is used only to run and support the service, as described in the privacy policy.
How do I report a security problem?
Write to [email protected] with what you found and how to reproduce it. Please do not access other people's data while testing.
Policies
- Privacy policyHow school records are stored and processed, with the school as controller and SchoolEasy as processor.Read more
- Student and child data policyNo advertising, no behavioural profiling, educational purpose only, and what parents can see.Read more
- AI transparency noticeHow the built-in AI works: permission boundaries, human confirmation for changes and what data it sees.Read more
- Terms of serviceAccount creation, administrators' control of credentials, data and intellectual property ownership, and acceptable use.Read more
Questions about data protection?
Book a demo and ask us anything about how your school's records are handled.
- Free plan, no card needed
- Set up in an afternoon
- Role-based access for every account
Page updated