Privacy and security
Data about children, treated like it
Each institution apart
Every institution is its own tenant. The database itself refuses a request from one institution for another’s rows, and an automated test tries exactly that for every table on every change before it ships.
Confidential by default
Marks and remarks belong to the staff who teach the class and to the administrators. Coordinators and heads see counts and status unless an administrator gives them more, and a view-only role sees numbers only.
No access for bhusku
The people who run revU see each institution’s name and counts, never its records. Creating an institution for a client gives us no access to it.
Every change recorded
Each mark keeps its history: who changed it, when, and why, when a locked assessment is changed. Administrators see a history of changes across the institution.
Sign-in done properly
Sign-in runs on Clerk, shared with schedU, with email codes, Google and an institution’s own single sign-on. revU never stores a password.
No advertising, no profiling
No advertising, no profiling for marketing, no tracking of children. Product measurements carry no names, marks or remark text.
Staff approve every remark
Where revU drafts a remark, the draft is built from the evidence, checked, and shown to the member of staff who signs it. Nothing reaches a family until they approve it.
Who processes data
Railway runs the server and database, Cloudflare serves the app, and Clerk handles sign-in. The institution decides how its data is used; bhusku processes it on the institution’s behalf.
Questions from your data protection officer are welcome at [email protected]. Read our privacy notice.