Tenant isolation
School-facing routes establish tenant context; tenant-owned records are expected to remain scoped to the active school.
SECURITY & TRUST CENTRE
Security belongs inside every workflow—not in a footer claim.
ShuleMatrix handles school, learner, academic, payment and attendance data. The architecture therefore relies on tenant context, server-side authorization, authenticated integrations and auditable operations.
✓
Defence in depthIdentity · Tenant boundaries · Policies · Audit · Private files · IdempotencyAPPLICATION CONTROLS
Security mechanisms visible in the current application architecture.
Authentication
Login verification, forced password rotation and session handling protect access before privileged workflows.
Authorization
Middleware, policies and permission checks enforce privileged actions on the server rather than trusting hidden buttons.
Auditability
Sensitive areas such as finance, biometrics, school administration and platform operations have dedicated audit concepts/services.
Protected files
Sensitive student documents and paid marketplace sources are delivered through private/authorized workflows rather than public file paths.
Payment safety
M-Pesa commerce uses server-side callbacks and idempotent handling so duplicate provider delivery does not repeatedly grant value.
Biometric trust
Authenticated agents, adopted devices, device health and event ownership checks reduce ambiguity in biometric ingestion.
Rate limits
Public acquisition/support and authentication-sensitive endpoints use throttling to reduce abuse.
DEPLOYMENT RESPONSIBILITY
Some security facts belong to the production environment, not the source code.
Hosting location, retention periods, backup schedules, recovery objectives, subprocessors, regulatory registrations and incident contacts must match the actual deployment and contracts. ShuleMatrix should not advertise these as facts until verified.
□ Configure encrypted transport and secret management
□ Verify backup frequency and restoration tests
□ Define retention and deletion procedures
□ Record production subprocessors
□ Maintain patching and incident-response procedures
□ Review access periodically
RESPONSIBLE OPERATIONS
Security questions schools should ask.
Can a hidden menu item replace authorization?
No. Interface visibility is convenience only. Sensitive actions must remain protected by server-side middleware, policy or tenant checks.
Should credentials be sent to support?
No. Do not send passwords, API keys, M-Pesa secrets, biometric tokens or other credentials in tickets or email.
Who is responsible for lawful school data use?
Schools and deployment operators must determine their applicable legal obligations and configure access, retention and operational controls accordingly.