Your records are yours, kept separate, and kept safe.

Every tenant-owned table carries an organisation key with row-level security. Automated tests assert that a member of one organisation cannot read or write another’s records, through the UI, API, crafted IDs, file URLs or exports.

Access is evaluated server-side from an authenticated membership: identity → membership → scope → permission → entitlement → record → state. Client-supplied role or organisation IDs are never trusted.

Role and permission changes require high privilege, are server-only, and are written to an immutable before/after audit. A user cannot escalate their own role by editing a request payload.

Data is encrypted in transit (TLS) and at rest by the infrastructure provider. Provider credentials, webhook secrets and privileged database clients live only in server and worker contexts; the browser never receives a service key.

Privileged and security actions append to an immutable audit trail. Training, safety and compliance records use versioned amendments rather than silent overwrites, and support access is logged into the customer’s own trail.

Objects are namespaced by organisation, served through short-lived signed URLs, and access is checked, never derived from mere knowledge of an object key.

Your school’s records are held in the UK/EU region. Where a sub-processor processes limited data outside the UK, the transfer is covered by the UK IDTA or SCCs with a transfer risk assessment. Region choice for groups with specific residency requirements is available on enterprise agreements.

A small set of sub-processors: cloud hosting, database and file storage, email delivery, error monitoring, and the integrations a school switches on such as weather, registry lookups and accounting. The itemised current list, with each one’s location and transfer safeguard, is provided with the DPA, and we notify customers before it changes.

The database is continuously backed up with point-in-time recovery by our infrastructure provider. Restore procedures are documented; scheduled restore-testing is on the roadmap.

Records are retained while your account is active and thereafter as you direct, reconciled with the regulatory retention a training organisation must observe. Deletion and export requests are honoured under the DPA.

We monitor the service and, on a security or availability incident, notify affected customers with what we know and what we are doing, then follow up with a summary. Formal notification timeframes are set out in the DPA.

The school is the controller and FlyerOS the processor for hosted data, with retention classes, legal-hold exceptions and data-subject request workflows. Read-auditing applies to special-category data.

Built to recognised security practices: strict tenant isolation, least privilege, and encryption in transit and at rest. We are glad to complete a security questionnaire as part of procurement.

We run internal security review and automated checks. An independent third-party penetration test is planned ahead of general availability, with a summary available to customers under NDA.