Security

How we protect your school.

Plain statements about encryption, isolation, access, uptime, and incident response. Every claim is either live today or explicitly roadmap.

Encryption & data handling.

Encryption in transitAll traffic between your browser and EduNex uses TLS 1.2 or higher.
Encryption at restDatabase and file storage are encrypted at rest by our infrastructure provider.
Row-level securityEvery school’s data is isolated at the database layer. A school can only ever read its own records.
Per-school isolationSchools are logically separated. There is no shared dataset between customers.

You own your dataEvery record your school enters belongs to your school. EduNex is a custodian, not an owner.
Export any timeStudents and records can be exported to CSV at any time, from within the app.
Delete on requestClosing your account permanently deletes your school’s data within 30 days, except where law requires retention.

Email + password authenticationAccounts are protected by Supabase Auth with hashed credentials and session tokens.
Role-based access controlOwner, admin, and staff roles with scoped permissions.
Single sign-on (SSO)SAML 2.0 and OIDC for schools and districts that require it.
Audit logEvery read and write, attributable to a user, retained for 12 months.

Uptime targetWe target 99.9% monthly uptime for the application and API.
Automated backupsDatabase backups run daily, with point-in-time recovery available on request.
Geographic failoverMulti-region failover for schools that require it.

We acknowledge security reports within 2 business days.

In the event of a confirmed data breach affecting customer data, we notify affected schools within 72 hours.

Report a vulnerability to security@edunex.africa.