Student and financial records deserve more than a shared login.
EduCore is multi-tenant by design — many schools share the same platform, but never each other's data. Here's what that actually means underneath the interface.
Isolation enforced by the database, not just the app.
One school's data never appears in another's
Every school's records — students, staff, fees, academics — are isolated at the database level by row-level security policies, not just filtered in the app's interface. A school owner or teacher can only ever see their own school's rows.
Role-based permissions, not all-or-nothing accounts
Staff accounts hold only the permissions their role needs — a teacher's account can't reach payroll, and a finance officer's account can't reach safeguarding records, unless the school owner explicitly grants it.
An audit log, not a silent system
Sensitive actions are recorded to an audit log a school owner can review, rather than disappearing the moment they happen.
Privileged database functions are locked down
Functions that run with elevated database privileges are written to a hardened pattern (a fixed, pinned execution path) that closes off a well-known class of database-privilege-escalation bugs, rather than left to each function's default behaviour.
M-Pesa payments are confirmed server-side.
A payment only posts to a student's account once Safaricom's own confirmation reaches EduCore directly — not because someone in the school typed in an amount. Cash, bank, and cheque payments are the only ones ever recorded on an officer's say-so, and are marked accordingly.
Reviewed for known vulnerabilities.
Third-party packages are reviewed for known vulnerabilities as part of our security process. Automated scanning on every change is on our roadmap, not yet in place.
Where this stands today
EduCore has not yet obtained a formal third-party security certification, and this page does not claim one. The practices above reflect EduCore's own architecture and engineering choices as built today, made with Kenya's Data Protection Act, 2019 in mind. Details on how information submitted through this website specifically is handled are in the Privacy Policy.
Ask us anything about how your school’s data is handled.
A demo is a good place to raise security questions directly.
Book a Demo