Security & data protection

Last updated: TODO — add date

Data isolation

ShuleMatrix is multi-tenant: every school's data is logically separated from every other school's. No school can query, view, or export another school's records under any user role.

Kenya's Data Protection Act, 2019

Because ShuleMatrix stores personal data belonging to minors — including academic performance, attendance, discipline records and in some cases health notes — we process this data as a data processor on behalf of your school, which acts as the data controller. Schools remain responsible for obtaining appropriate parental/guardian consent where required under the Act.

Access control

• Role-based permissions — a class teacher cannot see another class's marks before approval; a parent can only see their own child's records.
• Every marks change is logged with a timestamp, the user who made it, and (where applicable) a reason for the edit.
• Locked exams can only be unlocked by a school administrator, and unlocking is itself logged.

Data storage & backups

What we don't do

• We do not sell or rent student or school data to third parties.
• We do not use student data to train external models or share it with advertisers.

Reporting a concern

If you believe there has been unauthorised access to your school's data, or you have a data protection question, contact us at [email protected] or through our contact page.