Security & your data

Your data is separated at the database, not in the code

Every institution on iSkooll has its own isolated set of records. That separation is enforced by the database itself through row-level security: each request runs under an application role that can only see rows belonging to the institution the signed-in user belongs to. A query that forgets to filter by institution returns nothing rather than somebody else's students.

This matters because the usual approach — remembering to add a filter in every query — fails the first time a developer forgets. Here the database refuses, not the developer.

Who can see what, inside your institution

• Every user has a role, and every role carries an explicit list of permissions.
• Roles are yours to shape — an accountant who should not see exam marks does not see them, and a class teacher sees their own classes.
• Staff who should never sign in (office assistants, support staff) are recorded as employees with no login and no password at all.
• Guardians see only their own children, through a separate portal.

What is written down when something changes

Record changes and data exports are written to an audit trail: who did it, what changed, and when. This is what lets an institution answer “who altered this mark?” or “who exported the student list?” months later, rather than taking someone's word for it.

Passwords and sensitive fields

• Passwords are stored as bcrypt hashes (cost factor 12). Nobody at iSkooll can read a user's password, including us — a forgotten password is reset, never looked up.
• Sensitive identifiers such as a student's birth registration number are encrypted with AES-256-GCM before they are stored, under a key held outside the database.
• Traffic between your browser and iSkooll is encrypted in transit (HTTPS).

Where it runs

iSkooll runs on Google Cloud in the Singapore region (asia-southeast1), on managed services rather than a machine under someone's desk. Singapore is the nearest region to Bangladesh that offers this, which keeps the service quick from Dhaka while staying on infrastructure with real operational guarantees behind it.

Your data is yours, and you can take it

You can export your students, guardians, classes, subjects, fee types, invoices, payments and the attendance log to Excel at any time, from inside the application, using an account with the right permission. Report cards, admit cards, ID cards, certificates, receipts and tabulation sheets print or save as PDF.

That path is open the entire time you are a customer — not something you have to request when you leave. We would rather be easy to leave than hold anyone by their own records.

What we do not do

• We do not take a commission on the fees you collect. There is no payment gateway inside iSkooll, so your money never passes through us.
• We do not sell, rent or share your institution's data with anyone.
• We do not use your students' records to train anything, or mine them for our own purposes.

Reporting a security problem

If you believe you have found a vulnerability, please tell us before telling anyone else. We will confirm we have received it, and we will not pursue anyone who reports a genuine issue in good faith and gives us a chance to fix it.