Security at Schoolyi

Defense in depth, not checkbox marketing

A school ERP breach erodes parent trust for years. Schoolyi scopes access by role and assignment - a homeroom teacher sees their classes, finance sees fee ledgers, parents see linked children only. That scoping is enforced server-side on every request, not hidden behind UI menus.

Encryption and transport

Traffic uses HTTPS in transit. Credentials are hashed; sessions expire per policy. File uploads for admissions documents and staff records inherit the same transport protections as gradebook data.

• TLS for browser and API traffic
• Password hashing with industry-standard algorithms
• Optional SSO for centralized identity control
• Secure cookie settings for session management

Access control and audit

Permission matrices map modules to roles - registrar, bursar, teacher, parent. Sensitive exports and bulk downloads should be limited to roles that need them. Activity logs help investigators answer who changed a fee waiver or published report cards.

Secure development lifecycle

Changes pass code review and automated checks before release. Dependencies are monitored; critical patches ship on a defined cadence. Feature flags let schools enable modules gradually rather than exposing half-configured workflows.

Hosting and segmentation

Production workloads run on managed cloud infrastructure with network segmentation between application and data tiers. Backups and restore procedures are tested. Data residency options are documented per deployment region for international buyers.

What schools should configure

Strong password policy, limited admin accounts, and regular review of role assignments after staff turnover. Disable ex-employee access the day they leave - HR offboarding and IT access review should be the same ticket.

Reporting security concerns

Schools and researchers can report vulnerabilities through the published security contact. We acknowledge reports and coordinate disclosure timelines with affected customers when necessary.