Security & your data
Your school gets its own database. Not a row in someone else’s.
What the isolation actually is, who can see what once you are inside, and how you get everything back out. Plus the plain list of what Skooly does not have.
- Isolation A database per school
- Access Per-module roles
- Two-factor Optional, per school
- Your data Exported on request
Isolation
What “your own database” actually means.
It is the strongest thing we can tell you about your data, so it is worth understanding properly instead of taking as a slogan.
Before any of it, read what Skooly does not have. If your procurement needs a certificate, that list settles the matter and nothing above it will help you.
How a school is set up
When we create your school, Skooly runs a CREATE DATABASE
statement and migrates the school tables inside it. Your students, staff,
fees, attendance and results are the only records in that database.
The common alternative is one large database where every school’s records
share the same tables. They are held apart by a school_id column
that each query has to filter on. That design holds until one query forgets.
Why the difference matters
Skooly points your pages at your database. A query running for your school cannot return another school’s students, because those rows are not in the database the connection is open to. There is no filter left to omit.
- A mistake in your own role setup exposes records to your staff. It cannot expose them to another school.
- A backup is taken from your database alone. Nothing has to be sifted out of a shared table to build it.
- A restore puts your school back without touching anybody else’s records.
- When you leave, the export we hand you is your database — not a query run against everybody’s.
| The question | One shared database | A database per school — Skooly |
|---|---|---|
| Where your records sit | In the same tables as every other school | In tables that hold your school and nothing else |
| What separates schools | A school_id condition written into every query | The database connection itself |
| If one query omits the filter | Another school’s rows can come back | There is nothing else in the database to come back |
| Where a backup comes from | Sifted out of tables every school shares | Your database, and only yours |
| What a restore touches | Rows inside tables other schools also use | Your database, and only yours |
Access control
Inside your school, the role decides what opens.
Roles belong to your school and permissions are set per module. Your fee clerk sees fees. Your class teacher sees her own sections.
Owner / principal
Every module, every campus, plus who else gets an account and what that account can open.
Administrator / office
Whatever you grant, module by module. Most schools give the office everything except system settings.
Accountant / fee clerk
Fees, payments, receipts and the defaulters list. No marks, and no salaries unless you grant them.
Class teacher
Her own sections — Class 6-B and 7-A, not the whole school. Attendance, marks and homework for those children.
Parent
One child’s attendance, results, fees and messages, in the app. Nothing to edit.
Two-factor authentication exists and it is your choice. It stays off until your school switches it on. Put it on the accounts that can see the whole school first, before you ask every teacher to carry it.
The rest of the perimeter.
If you leave
Your records go with you.
A school should be able to walk away with everything it put in. Here is exactly how you get it, and who does which part.
Before you commit
What Skooly does not have.
Everything above this line is in the code and we will show you where. This is the other half, and a procurement team will ask for it on the first call.
Skooly holds no SOC 2 report and no ISO 27001 certificate. No third party has audited us, and no audit is scheduled.
We run no formal penetration-testing programme and no bug-bounty programme.
We publish no uptime figure, no status page and no service-level agreement.
We do not claim encryption at rest. Traffic is encrypted in transit over HTTPS, and that sentence says all it says.
If your procurement requires any of these, ask us before you commit.1 We will put in writing what we can and cannot do, and you can decide with the real answer in front of you.
Why this is on the page at all
A school that finds this out after signing has a much worse problem than one that reads it here. Many schools have no certification requirement. The ones that do need the answer on day one, not in month three.
None of it is permanent. When one of these changes, this page changes — on the day it becomes true, and not before.
- Email [email protected] or send the question on WhatsApp. Ask for our data-processing terms in the same message — they are provided on request.
Questions
Common questions
Is our data in a shared database with other schools?
No. Your school is created with its own MySQL database and the school tables are migrated inside it. Your students, staff, fees and results are the only records in it.
A query running for your school cannot reach another school’s rows, because those rows are not in the database the connection is open to. Separation is not a filter someone has to remember to write.
Are you ISO 27001 or SOC 2 certified?
No. Skooly holds no third-party certification of any kind and none is in progress. If your procurement requires a certificate, tell us before you commit. We will say plainly that we cannot meet that requirement today.
Is the data encrypted at rest?
We do not claim it, so please do not assume it. What we do claim is that traffic to and from Skooly is encrypted in transit over HTTPS, and that the origin sits behind Cloudflare. If encryption at rest is a hard requirement for your board, raise it before you sign.
Can we turn on two-factor authentication?
Yes. Two-factor sign-in is available and optional — it is off unless your school switches it on. Turn it on for the accounts that can see the whole school first.
Can a class teacher see another class’s marks, or the fee ledger?
Only if you grant it. Roles belong to your school and permissions are set per module, so a class teacher normally sees her own sections and nothing financial. You decide what each role opens, and you can change it later.
What is your uptime, and do you have a status page?
We publish neither. There is no status page and no service-level agreement. We would rather say so than quote a figure we are not measuring against a commitment. If your contract needs an availability clause, put the question to us in writing before you commit.
If we leave Skooly, what do we get back?
Every list exports to Excel or PDF from the screen you are on, and backups of your school’s database are taken from the admin panel. For a complete copy, ask us and we provide a full export — that commitment is in our privacy policy.
Getting the backup file off the server is something we do for you today. Make that request part of your migration plan rather than assuming you can pull it yourself.
Where is the server?
Ask us and we will tell you exactly where your school’s database sits, in writing. We would rather answer that for your board directly than post a hosting detail here and let it go stale.
Send us the questionnaire before you sign anything.
Tell us what your board needs to see. You will get a straight answer on each line — including the lines where the answer is no.
Your data stays yours · Full export on request