How School Vault protects child data

Who handles your data

School Vault is the data processor. Your school is the data controller. This means:

• You decide what data is entered into School Vault and for what purpose.
• School Vault processes that data only to provide the service you have subscribed to.
• School Vault does not sell your data, use it for advertising, or share it with third parties except as required by law or as you direct (e.g. Paystack for payment processing).

Encryption in transit and at rest

• In transit: all data between your browser (or parent portal) and School Vault's servers is encrypted using TLS 1.2 or higher. Connections over plain HTTP are automatically redirected to HTTPS.
• At rest: the database and file storage are encrypted using AES-256. Uploaded photos, PDF documents, and health records are stored in encrypted object storage, they cannot be accessed via a direct URL without a valid authenticated session token.

Access controls

School Vault uses role-based access control (RBAC). Every action in the system is gated by the user's role. No staff member can see data that their role does not permit. Detailed documentation is in article 8.3.

Key principles:

• Parents can only see their own child's data, never another family's records.
• Teachers see only the classes they are assigned to.
• The Bursar sees financial records but not health or welfare records.
• The School Nurse sees health records but not financial records.

Password and authentication security

• Passwords are hashed using bcrypt with a per-user salt, plain-text passwords are never stored.
• All sessions use JWTs with a 24-hour expiry and mandatory re-login after expiry.
• Failed login attempts are rate-limited. After 5 failed attempts, the account is temporarily locked and an alert is sent to the account owner.
• School Admin accounts can enforce mandatory password changes for staff on first login.

Data residency

School Vault's primary infrastructure is hosted in Nigeria (Lagos data centre). Backup data is replicated to a secondary data centre also in Nigeria, in compliance with NDPR data localisation requirements. No child data is stored on servers outside Nigeria without explicit school owner consent.

What School Vault does not do

• School Vault does not access your data for training AI models.
• School Vault does not allow advertising networks to track users within the platform.
• School Vault support staff can only access your data to investigate a reported issue, and only with audit-log documentation of the access (article 8.2).

Security incident reporting

If you suspect a security incident (unauthorised access, data breach, suspicious login), contact support@schoolvault.ng immediately. School Vault will:

1. Investigate within 24 hours.
2. Notify you of the outcome and any steps taken.
3. Assist with NDPR breach notification obligations if personal data was affected.

Common mistakes

• Assuming the platform is secure without reviewing your own access controls, most data breaches in school software are caused by shared passwords or overly broad role assignments, not platform vulnerabilities. Review your staff access regularly (article 8.3).
• Not deactivating staff accounts when they leave, a former employee with an active account is a significant security risk regardless of how the platform itself is secured.