§ 00—Security
Security & privacy
Visibility, with boundaries.
A school platform holds information about children, families and staff. EdBanz is designed so that everyone sees what their role needs — and nothing else. Here is what that means in practice.
§ 01—Access model
Two layers decide who sees what.
Every request is checked against the user’s role — admin, management, teacher, assistant, student or parent. Management staff are then checked again against a custom role that grants view, create, edit or delete per module. Admins always have full access; parents only ever reach their own children.
§ 02—Controls
What is in place today.
Access
- Role-based access
- Admins, management staff, teachers, students and parents each reach only their own portal and permissions.
- Custom roles for management
- Grant view, create, edit and delete per module. Permissions are enforced on the server, not just hidden in the interface.
- Data scoped by branch and family
- Records belong to a branch, and parents see only their own children.
Sign-in & sessions
- Accounts issued by your school
- School admins create staff and student accounts and share the credentials. Students don’t need a personal Google, Microsoft or social account.
- One-time codes for teachers and students
- Teacher and student sign-in is confirmed with a one-time code sent by email.
- Sessions you can end
- Active sessions are tracked and can be revoked, signing the device out immediately. Schools can limit accounts to one session at a time.
- Hardened sign-in
- Passwords are hashed, sign-in attempts are rate-limited and refresh tokens rotate on every use.
Privacy & retention
- Consent and data requests
- Consent records and data subject requests — access and export — are handled inside the platform.
- Automatic retention
- Proctoring recordings are deleted automatically once they pass the retention period.
- Audit logs
- Significant actions are logged for accountability and review.
Hosting
- Hosted on AWS
- School data is stored on Amazon Web Services.
Transport
- Encrypted in transit
- Traffic is served over HTTPS. In production, API requests and responses are encrypted a second time at the application layer.
- Validated input
- Every request is validated against a strict schema before it reaches school data.
§ 03—Begin
- Engaged students.
- Informed parents.
- Less work for teachers.
- Complete visibility for management.