Infrastructure
- ·EU regions only
- ·Age-encrypted backups + WAL
- ·Object-locked, retained offsite
- ·Rate-limited, bot-filtered edge
SECURITY
Secure, compliant, and honest about it.
School data is sensitive — students, staff, choices. Here’s exactly how we protect it, what we comply with, and what we don’t (yet) claim.
GDPR-compliantEU-hostedNo trackersNo data selling
What we comply with — stated plainly.
We’d rather under-claim than mislead. Here’s the real posture.
GDPR
Compliant
Processed under EU 2016/679 + French Loi Informatique et Libertés. Data-subject access, a signed DPA, and full transparency on what we hold and why.
EU hosting
Data stays in Europe
Self-hosted on European infrastructure. Your school’s data never leaves the EU and is never sold or shared.
SOC 2 / ISO 27001
Aligned, not certified
We run the control frameworks in practice — access control, encryption, backups, audit logs — but we do not claim a formal certification we haven’t completed. See the gap analysis on /Security.
FERPA / COPPA
US context
US student-data laws. Relevant for American schools; we align with their principles (records, consent, no ad-tech) without claiming a formal audit.
Defence in depth, no theatre.
Access control
- ·MFA on admin accounts
- ·Row-level security per school
- ·Short-lived sessions
- ·Tailscale-only server access
Data privacy
- ·No third-party trackers
- ·Strictly-necessary cookies only
- ·Per-school data isolation
- ·No AI training on your data
The rules we hold ourselves to.
Data minimisation
We collect only what a timetable needs — names, subjects, choices, staff. No behavioural profiling, no ad-tech.
Isolation
Every school’s data is row-level isolated. One school can never read another’s.
Retention
Kept while you’re a customer; deleted on request and on offboarding, backups included on a fixed schedule.
Transparency
What we hold, where, and why is written plainly in the Privacy Policy and DPA — no dark patterns.
No AI on your data
Student and staff data is never used to train models. The solver is a constraint engine, not a learning system.
VERIFIED INDEPENDENTLY
Checked by people who don’t work for us.
- Hosted in the EU on our own servers
- GDPR Art. 28 data processing agreement
- Two-factor authentication
- Team roles & activity journal
- Encrypted, immutable backups
- Breach notice within 72 h
Every control, including what we don't do yet: Security & compliance
Read the fine print — it’s actually readable.
Our Privacy Policy, DPA and sub-processor list are written for humans.