Security

How we look after your school’s data

No badges or buzzwords — this is what the product actually does. If your IT team has questions, we are happy to go through them.

Each school’s data is kept separate

  • Every school has its own address, and every query is scoped to that school.
  • Automated tests that check one school cannot read another school’s data run before each release.
  • Platform administrators work across schools only through a separate, audited console.

People see only what their role allows

  • Six built-in roles — administrator, teacher, accountant, office staff, parent and student — plus custom roles with fine-grained permissions.
  • Parents see only their own children. Teachers see the classes they are assigned to.
  • Staff can turn on two-factor sign-in with any authenticator app.

Sign-in and sessions

  • Passwords are stored as salted hashes, never in plain text.
  • Sessions use secure, http-only cookies that page scripts cannot read.
  • Repeated failed sign-ins lock the account temporarily.

A record of who did what

  • Sensitive actions — fee changes, result locking, permission changes and more — are written to an audit log with the person and time.
  • When our support team signs in to help you, it is recorded as support access.

Your data stays yours

  • An administrator can export every record of the school as a single file, at any time.
  • Point-in-time snapshots with a checksum can be taken and downloaded by your school.
  • Secrets you add — payment gateway, SMS and AI keys — are never included in exports, and AI keys are encrypted at rest.

Where it runs

  • Our hosted cloud serves every page over HTTPS.
  • Schools and groups that need it can run iMetricSchool on-premise, on their own server.
  • A public status page shows the live health of the platform.

AI, only if you choose it

  • AI features are off by default. Nothing is sent to an AI provider unless an administrator turns it on.
  • You connect your own OpenAI, Google or Anthropic account and set a monthly budget.
  • The assistant can only run a fixed set of reviewed queries and respects each person’s permissions.

Questions from your IT or data-protection lead?

We will answer them directly — hosting, backups, access, data processing — before you commit.

Ask a security questionSystem status

See it running with your school’s questions

A walkthrough with our team: bring your fee structure, timetable or reporting headaches and we will show you how they work in iMetricSchool.

Book a demoStart 30-day free trial