Security
How EduPrefect protects your school's data
A school holds fee records and children's details. This page says what is in the product today, what is not, and what we do not yet claim.
In the product today
What protects your records
Every school's records are kept apart
Each record belongs to one school, and school-scoped records are filtered to the signed-in school. This is enforced in application code. A second, database-level layer (Postgres row-level security) is in our plan and is not built yet.
Role-based access
Proprietor, principal, bursar, registrar and teacher each see what their role allows. Viewing student personal data and managing students are separate permissions.
An audit log of sensitive admin actions
Actions such as fee setup, student erasure and role changes record who did what and when. Staff with the audit-log permission can review it. The log does not cover everything: entering scores is not recorded in it.
Passwords, sign-in limits and lockout
Passwords are stored as bcrypt hashes. Sign-in attempts are rate-limited per address and per email, and repeated failures lock the account.
HTTPS everywhere
Traffic to the app and the API is encrypted over HTTPS, and browsers are told to use HTTPS only (HSTS).
Payments settle to your school
Online payments go through Paystack and settle to your school's own verified subaccount. EduPrefect does not hold your fees, and card details are entered with Paystack. Changes to a school's payout account need a second approval.
A placeholder for the child's name in AI drafts
For AI report-card remarks the child's name is replaced with a placeholder in the draft request, and EduPrefect restores it when the remark is approved and published. This does not catch a name a teacher types into free text. A teacher reads and edits every remark.
Nigeria Data Protection Act
Tools for the school's data-protection duties
The school decides what to collect and why. EduPrefect gives you tools to handle the requests that follow.
Consent forms
Build consent forms from templates and assign them to students or guardians. Parents answer in the app or from a link.
Data export
An administrator with permission to view student personal data can export everything held on a student, for a data-subject access request.
Tracked erasure requests
Erasure is not a button anyone can press. It runs as the last step of a tracked deletion request: intake, identity check, then fulfilment by a second person, or rejection.
We describe EduPrefect as built to support NDPA. We do not describe it as NDPA compliant or certified.
Stated limits
What we do not claim
Encryption at rest
We make no claim on this page about encryption of stored data. We are checking it against our hosting, and we will state it here only once it is confirmed.
Where data is hosted
We make no data-residency claim. If your school needs to know where its data sits, ask us before you sign.
Certifications and audits
EduPrefect has no external security accreditation to show and has published no independent penetration test.
Questions
Questions schools ask about security
Does EduPrefect satisfy the Nigeria Data Protection Act?
We describe EduPrefect as built to support the Nigeria Data Protection Act. It has consent forms, a data export, tracked erasure requests and an audit log. Meeting the Act also depends on how your school handles data, so we claim support for your duties and no more.
Can one school see another school's data?
No school-scoped screen is meant to show another school's records. Separation is enforced in application code: school-scoped records are filtered to the signed-in school. A database-level layer on top is planned and not yet built.
Does EduPrefect hold our school fees?
No. Online payments settle to your school's own verified Paystack subaccount. EduPrefect charges a platform fee on online payments, which is shown before the parent pays.
Can a parent ask for their child's data to be deleted?
Yes, through a tracked deletion request. The school verifies who is asking and a second person fulfils or rejects it. Every step is recorded.
Is stored data encrypted?
Traffic is encrypted with HTTPS. We do not yet make a claim about encryption of stored data, because we have not finished confirming it for our hosting. Ask us for the current position.
Read the privacy policy, the permission matrix and separation of duties in the documentation. To report a security concern, write to [email protected].
Ask us anything about your data
We will walk you through security, compliance and how your data is handled, on a demo.