Sahel EDU

Protecting a school’s data: who sees what, how people sign in, what is backed up

A school holds marks, children’s photos, identity documents, health records and each family’s payment status. Losing them, or letting anyone read them, is a failure towards parents. Sahel EDU applies concrete measures: data separated by school, two-step sign-in for senior staff, limited sessions, encrypted sensitive files, hourly backups and a log of actions.

What a school has to protect

School data security starts with a list of what the school holds. Part of that data concerns children, and much of it is sensitive: a leak can harm a family for a long time.

Marks, averages and class council decisions.
Parents’ identity documents and scanned birth certificates.
Health records and students’ special needs.
Photos of students and staff.
The amounts due, paid and unpaid for each family, and staff payroll.

The most common risks in a school

Incidents rarely come from a sophisticated attack. They come from everyday habits, which software can limit but which an organisation must also correct.

An honest inventory of these habits is the best starting point before changing tools.

A password shared among several colleagues, or written in a notebook.
An Excel file listing every family, copied onto a USB stick that circulates.
Photos of identity documents sent in a group chat.
A former staff member who keeps access after leaving.
A lost phone, still signed in to a head’s account.

Each school on its own, each person by role

Each school’s data is strictly separated from that of the others: a school never sees another school’s students. The only exception is the history of a transferred student, opened with the agreement of the school of origin.

Inside the school, permissions follow the role. A teacher sees only their classes, the PTA board and the proprietor have read-only access, and the head delegates permissions without giving everything to everyone. The data belongs to the school: it is neither sold nor shared.

A site specific to each school, with its data kept apart.
Roles: head, deputy head, senior supervisor, bursar, teacher, parent, student.
A teacher limited to their classes and subjects.
A suspended account signed out without delay.
Teacher evaluations that are anonymous by design.

Signing in: two-step verification and limited sessions

For the accounts that see the most data, the head, the deputy head and the accountant, two-step verification is mandatory. It relies on an authenticator app installed on the phone, and each account receives one-time backup codes in case the phone is lost.

These accounts also have a session limited to eight hours, with a visible timer, and cannot stay signed in indefinitely. If a password is reset, two-step verification is removed and must be set up again.

An authenticator app, with one-time backup codes.
An eight-hour session and a visible timer.
No permanent sign-in for these accounts.
Limits on repeated sign-in attempts.
A temporary password for parents, to be changed at first sign-in.

Encrypted files, hourly backups and a log of actions

Identity documents and admission scans are encrypted, as are health records, each reading of which is logged. Photos are private. The application’s pages load no resource from another site, and spreadsheet exports neutralise booby-trapped formulas.

Backups are made every hour, encrypted, in a separate and locked space, and a trial restoration is checked every night. An application error alerts the technical team. Sensitive actions, such as an export or the cancellation of a payment, are written to the log.

Identity documents, scans and health records encrypted.
A backup every hour, in a separate and locked space.
Proof of restoration checked every night.
A log of sensitive actions that the head can consult.
A full export of the school’s data, available to the head at any time.
An alert to the technical team when the application fails.

What we do not claim, and what remains to do at your school

On the protection of students’ and families’ personal data, read our page on the 2024 Cameroonian law, and have your practices reviewed by a lawyer.

Software does not replace good habits. Remove access for people who leave, do not share passwords, and keep the phone that holds the two-step verification in a safe place.

Disable the account of a departing staff member without delay.
Never share a password, even between trusted colleagues.
Train every newcomer in the school’s rules.
Keep the backup codes in a safe place.

Frequently asked questions

Can one school see another school’s data?

No. Each school’s data is kept apart. Only the history of a transferred student is opened, with the agreement of the school of origin.

Is two-step verification mandatory?

Yes for the head, the deputy head and the accountant, as well as for the platform console. It uses an authenticator app on the phone.

What happens to our data if an incident occurs?

It is backed up every hour, encrypted, in a separate space, and a trial restoration is checked every night.

Who owns the data?

The school does. It can export it at any time, in Excel and PDF; it is never sold or shared.

Can we assess these measures during the trial?

Yes. The free trial lasts 30 days, with no commitment. The price is then negotiated with each school and can be read on the Pricing page.

Try Sahel EDU for free

Try Sahel EDU free for 30 days, no commitment. Afterwards, the price is negotiated with your school and confirmed in writing.

Book a private demonstration See pricing How the trial works