Every school's data lives in its own isolated database, and every request runs through the same hardening layer regardless of plan.
Each school is provisioned its own database. Application code resolves the tenant from the request hostname before any query runs, so one school's data is never reachable from another's session.
Staff, admin, parent, and student portals are permission-scoped — each role only reaches the routes and data its permission set allows, enforced on every request, not just in the UI.
Sensitive actions inside a school's portal (records changes, approvals, settings edits) are written to an audit log that administrators can review.
If you believe you've found a security vulnerability, please contact us directly rather than filing a public report, so we can investigate before any details are shared.