A school hands us its children's records. That deserves proof.
Security at Schoolspine is architectural rather than procedural — the controls below are properties of how the system is built, which means they hold on the day a school signs up and the day it has ten thousand students.
Tenant isolation
Every school is a separate tenant, resolved from the hostname and never from anything the browser can set. Isolation is enforced in the data layer: a query that arrives without a tenant scope does not run, rather than quietly returning everything.
Authorisation on the server
Hiding a button is not access control. Every request is authorised against the permissions the account actually holds, by a guard that runs globally — so a route cannot be left unprotected by omission.
Ownership, not just permission
A parent holding “read students” must see their own children and no one else’s. Permission decides the capability; the guardian link decides which records it applies to.
Audit as a product feature
Important changes — marks, fees, permissions, publication, account status — are recorded with who, what, when and the values before and after, and surfaced to school leadership rather than buried in a server log.
Policies you set
Password rules, session lifetime, MFA posture and lockout thresholds are configuration. One school expires passwords every 30 days, another every 90, another never.
Validated input, rate-limited access
Requests are validated against a strict schema — undeclared fields are rejected outright, not silently ignored — and sign-in is rate limited per address on top of per-account lockout.
Operational practices
Transport
All traffic over TLS. Session tokens are httpOnly cookies the browser script cannot read.
Passwords
Hashed with bcrypt. Never logged, never returned by any endpoint, never recoverable — only resettable.
Sessions
Short-lived access tokens with separate refresh, revocable per session.
Backups
Automated database backups with a documented restore procedure.
Environments
Development, staging and production are separately configured and isolated.
Secrets
Held in environment configuration, never in the repository or the client bundle.
On the roadmap
The platform is engineered towards these, and the underlying controls — access control, audit, environment isolation, backups — are already in place. Ask any vendor for the report itself.
- Formal SOC 2 Type II audit
- ISO 27001 certification
- Third-party penetration testing programme
- Customer-managed encryption keys
- Published status page and incident history
Send us your security questionnaire.
We would rather answer the hard questions before you commit than after. Send the document your board uses and we will complete it.