Security
Built for the day someone tries.
Smart Edu holds learners’ details and a school’s money. We assume passwords will be stolen and design so that a stolen password alone is worth nothing.
- 01Keyed computerA Smart Edu key inside the computer’s security chip
- 02Approved networkOnly from the school’s own internet line
- 03Two-step sign-inPassword plus an authenticator code
- 04Role permissionsEach person sees only their job
- 05School wallsThe database keeps every school apart
- 06Sealed recordsChanges are fingerprinted and checked nightly
- 07Encrypted backupsKept with keys that never touch the server
In detail
Eight protections, in plain words.
01
Only keyed computers get in
Each school computer that may open the staff area is enrolled once. A key is created inside the computer’s own security chip and cannot be copied to another machine. A browser without that key sees the public website and nothing more, even with the right password.
02
Only from the school’s network
Staff access is also tied to the school’s approved internet addresses. If the address changes, access stops until the school, or Digital Access after a phone call, approves the new one.
03
Two-step sign-in
A password and a six-digit code from an authenticator app. Repeated wrong attempts lock the account. Idle sessions end on their own; the bursar’s sooner than a teacher’s.
04
Each person sees their job
A class teacher sees their classes. The bursar sees money. The head sees the school. Permissions are set per role and can be narrowed per person.
05
Schools cannot see each other
The database itself enforces the wall between schools on every query. Even a mistake in our own code cannot show one school’s learners to another; we test this on every release.
06
Records that show tampering
Every action is written to a chained audit log. Marks and money records carry seals. A nightly check verifies the chain and the seals and reports any break.
07
Two people for sensitive changes
Approving a new computer and approving a credit note each need a second person. One stolen account is not enough.
08
Keys kept offline
The keys that sign licences and enrol computers are kept off any server, in a vault. Backups are encrypted to a key that the server never holds.
Your data
The school owns its data.
Learner information is processed under the Cyber and Data Protection Act [Chapter 12:07]. Digital Access acts for the school and does not use a school’s data for anything else.
Each school chooses where its backups go as well as ours: Backblaze or our own cloud, the school’s Microsoft 365, or a NAS, PC or USB drive at the school. A full export is available at any time.