Enterprise-ready

Built for students' data — and your IT team's sign-off

A school holds minors' records; they deserve real controls. Role-based access on every action, a full audit trail of who did what, multi-tenant isolation between campuses, encrypted integration secrets and OIDC-based delivery — documented control by control, not hand-waved.

Server-authoritative RBAC Full audit trail Multi-tenant isolation Encrypted secrets OIDC CI/CD — no stored cloud keys Edge TLS

How access works

The app asks what you can do, not what role you are

Every microservice publishes its own access rules, reflected at runtime from the code that guards each endpoint — a single source of truth the interface follows exactly.

  • Capability checks, not scattered role strings in the UI.
  • Hidden never means unenforced — the server returns 403 regardless.
  • "Done by…" names who can act, so nobody is over-exposed.
  • Field-level limits (pay, statutory IDs) on top of screen-level.
  • Governed role changes: mandatory reason, can't remove the last admin, full history.
Live access rulesfrom the server
Enrol studentRegistrar +2
Collect seat depositCashier, Principal
Change a user's rolesSuper admin
View another's payslipblocked (403)

Controls, by area

Authentication

BCrypt hashing · 5-strike/30-min lockout · forced first-login password change · strong password policy · stateless JWT with sliding refresh & idle timeout · server-side session records with admin revoke · single-use reset tokens · MFA policy.

Authorization / RBAC

Method-level access control across every service · reflected access-rules as the single source of truth · least-privilege safeguards · role delegation · scoped, expiring, single-view API tokens · constant-time internal keys · multi-tenant guard.

Audit & accountability

Central audit trail (user, IP, action, resource, outcome) · dedicated role-change log · row-level created-by / updated-by with optimistic locking across services.

Data protection & isolation

Multi-tenant & campus scoping via signed claims · AES-256-GCM encryption of integration secrets · environment-driven secrets · accessibility semantics throughout the UI.

Infrastructure & operations

GitHub Actions CI/CD with AWS OIDC (no stored keys) · Kubernetes on EKS (Terraform) · Let's Encrypt TLS · centralised logging + distributed tracing · VPN admin access.

Roadmap

MFA enforcement, field-level PII encryption, data anonymisation and automated backup/restore are supported as configurable policy today and are on the roadmap to full enforcement. We'll share our security overview and status candidly on request.

Request our security overview