Certifications, standards, and regulatory alignment

SOC 2 Type II

AICPA

Independent audit of security, availability, processing integrity, confidentiality, and privacy controls over time.

Schoolyi: Schoolyi maps platform controls to AICPA Trust Services Criteria — role-based access, encrypted sessions, change review gates, and audit-friendly activity exports for fee, exam, and roster workflows.

ISO/IEC 27001

International Organization for Standardization

International standard for information security management systems (ISMS) — risk assessment, policies, and continuous improvement.

Schoolyi: Operations follow ISO 27001-aligned practices: asset inventory, access control, secure development, incident response playbooks, and backup verification suitable for school ERP deployments.

ISO/IEC 27701

International Organization for Standardization

Privacy extension to ISO 27001 — privacy information management for controllers and processors handling personal data.

Schoolyi: Student, staff, and guardian records are handled with data-minimization defaults, purpose limitation, and export tooling so schools can meet processor obligations under ISO 27701-aligned programmes.

ISO/IEC 27017

International Organization for Standardization

Code of practice for information security controls for cloud services.

Schoolyi: Cloud deployment guidance covers tenant isolation, shared responsibility documentation, and secure configuration baselines for multi-school groups.

ISO/IEC 27018

International Organization for Standardization

Protection of personally identifiable information (PII) in public clouds acting as PII processors.

Schoolyi: Guardian portals, admissions forms, and student profiles are scoped so cloud operators and schools can demonstrate PII handling consistent with ISO 27018 expectations.

CSA STAR

Cloud Security Alliance

Cloud Security Alliance Security, Trust, Assurance, and Risk registry and attestation programme.

Schoolyi: Infrastructure and SaaS posture documentation supports CSA Cloud Controls Matrix mapping for districts evaluating cloud school ERP vendors.

NIST Cybersecurity Framework

National Institute of Standards and Technology (US)

Voluntary framework to manage and reduce cybersecurity risk — Identify, Protect, Detect, Respond, Recover.

Schoolyi: Security reviews with US K-12 IT leads reference NIST CSF functions: identity management, vulnerability patching cadence, logging, and recovery objectives for academic-year continuity.

PCI DSS

PCI Security Standards Council

Payment Card Industry Data Security Standard for organisations that store, process, or transmit cardholder data.

Schoolyi: Online fee collection integrates with PCI-compliant payment gateways — card data is tokenised and never stored in Schoolyi roster or finance modules.

General Data Protection Regulation (GDPR)

European Union

EU regulation on personal data processing — lawful basis, data subject rights, DPIAs, and cross-border transfers.

Schoolyi: Schoolyi supports GDPR-aligned operations: role-scoped access, data export for subject access requests, retention configuration, and DPA templates for EU and international schools.

UK GDPR & Data Protection Act 2018

Information Commissioner's Office (UK)

UK post-Brexit data protection regime — mirrors GDPR with UK-specific guidance for schools and MATs.

Schoolyi: Independent and state schools in England, Scotland, Wales, and Northern Ireland can map pupil records, parent communications, and safeguarding notes to UK GDPR roles and retention schedules.

CCPA / CPRA (California)

California Privacy Protection Agency

California Consumer Privacy Act and Privacy Rights Act — disclosure, access, deletion, and opt-out rights.

Schoolyi: US schools with California residents can document processing purposes for admissions CRM data and configure exports to honour access and deletion workflows.

PIPEDA

Office of the Privacy Commissioner of Canada

Canadian federal private-sector privacy law — consent, accountability, and breach notification.

Schoolyi: Canadian independent schools and groups can align guardian portals and staff HR records with PIPEDA fair-information principles.

LGPD (Brazil)

Autoridade Nacional de Proteção de Dados (ANPD)

Lei Geral de Proteção de Dados — Brazil's comprehensive data protection law for personal data processing.

Schoolyi: Brazilian and Latin American schools can configure lawful bases, DPO contact points, and export paths for student and employee records processed in Schoolyi.

PDPA (Singapore)

Personal Data Protection Commission Singapore

Singapore Personal Data Protection Act — consent, purpose limitation, and Do Not Call rules.

Schoolyi: International schools in Singapore can align parent SMS and email outreach with PDPA consent and notification requirements.

UAE Personal Data Protection Law

UAE Data Office

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data in the United Arab Emirates.

Schoolyi: Schools in Dubai, Abu Dhabi, and wider UAE can document cross-border transfers and parent consent for student records under UAE PDPL expectations.

India Digital Personal Data Protection Act

Government of India

India's national framework for processing digital personal data — notice, consent, and data fiduciary obligations.

Schoolyi: Indian K-12 groups can map student Aadhaar-adjacent workflows, fee receipts, and parent notifications to DPDP-aligned retention and grievance processes.

POPIA (South Africa)

Information Regulator (South Africa)

Protection of Personal Information Act — conditions for lawful processing in South Africa.

Schoolyi: South African schools can demonstrate accountability, security safeguards, and data subject participation for learner and staff records.

FERPA

US Department of Education

Family Educational Rights and Privacy Act — US student education record privacy and parent access rights.

Schoolyi: Directory information flags, transcript exports, and role boundaries keep unpublished grades and discipline notes off parent portals until coordinators release them — supporting FERPA-aligned workflows.

COPPA

US Federal Trade Commission

Children's Online Privacy Protection Rule — parental consent and data practices for services directed to children under 13.

Schoolyi: Admissions and student portals separate public apply flows from authenticated workspaces; schools control which modules minors access and what data is collected at enrollment.

SOPIPA (California Student Privacy)

California State Legislature

Student Online Personal Information Protection Act — restricts K-12 edtech use of student data for advertising and profiling.

Schoolyi: Schoolyi does not use student operational data for third-party advertising; processing stays within the school's educational purpose and configured integrations.

HIPAA-aligned health records

US HHS Office for Civil Rights

Health Insurance Portability and Accountability Act — safeguards for protected health information where clinics process medical records.

Schoolyi: Health clinic and medical visit modules support restricted roles, audit context, and minimum-necessary access patterns schools expect when storing clinic notes alongside student records.

WCAG 2.2 Level AA

W3C Web Accessibility Initiative

Web Content Accessibility Guidelines — perceivable, operable, understandable, and robust interfaces.

Schoolyi: Marketing pages and authenticated workspaces target WCAG 2.2 AA patterns — semantic markup, keyboard navigation, contrast, and form labels for staff and family portals.

Section 508

US General Services Administration

US federal accessibility requirements for electronic and information technology procured by government agencies.

Schoolyi: US public charter networks and districts referencing Section 508 in RFPs can review VPAT-aligned accessibility documentation on request.

EN 301 549

European Telecommunications Standards Institute

European accessibility standard for ICT procurement in the public sector, harmonised with WCAG.

Schoolyi: EU and UK schools subject to public procurement accessibility schedules can map Schoolyi UI components to EN 301 549 checkpoints.

Australian Privacy Act 1988

Office of the Australian Information Commissioner

Australian privacy principles for organisations handling personal information, including APP 11 security.

Schoolyi: Australian independent and Catholic school systems can align enrolment, fee, and pastoral notes with APP breach notification and access request workflows.

New Zealand Privacy Act 2020

Office of the Privacy Commissioner (New Zealand)

New Zealand privacy law — purpose limitation, security, and mandatory breach notification.

Schoolyi: NZ schools can configure retention and export for NCEA and pastoral records processed in Schoolyi.

APPI (Japan)

Personal Information Protection Commission (Japan)

Act on the Protection of Personal Information — Japan's core data protection statute.

Schoolyi: International schools in Japan can document cross-border transfers and parental notification for student data hosted on Schoolyi.

PIPA (South Korea)

Personal Information Protection Commission (Korea)

Personal Information Protection Act — consent, purpose specification, and security measures in South Korea.

Schoolyi: Korean international schools can align admissions CRM and fee modules with PIPA consent and destruction schedules.

Swiss FADP

Federal Data Protection and Information Commissioner (Switzerland)

Federal Act on Data Protection — revised Swiss law aligned with GDPR-style rights and cross-border transfer rules.

Schoolyi: Swiss private and international schools can map student dossiers and HR payroll data to FADP accountability and data security requirements.

EU Standard Contractual Clauses

European Commission

Approved contractual clauses for transferring personal data from the EEA to third countries under GDPR Chapter V.

Schoolyi: Cross-border school groups can execute EU SCCs with Schoolyi as processor when student data leaves the EEA — supporting Schrems II due diligence.