Security & Data Protection
Your school’s data, protected by design
Kairo CORE holds the records your school cannot afford to lose — students, guardians, fees and results. This page explains, in plain terms, how the platform keeps that data isolated, access-controlled and recoverable.
Every school has its own isolated workspace
Kairo CORE is multi-tenant: each school’s data lives in a separate workspace, and every request is bound to the school you are logged into. One school’s students, fees or documents are never served to another school’s users.
Role-based access for every staff member
Staff only see and do what their role allows. A form teacher’s view differs from a bursar’s; sensitive areas such as payroll, backups and platform administration require elevated permissions that you control.
Protected sessions and forms
Login sessions use secure, HTTP-only cookies, with session encryption available, and every state-changing form is protected against cross-site request forgery. Account activation links are single-use and time-limited.
Strong password storage
Passwords are never stored in readable form; the platform stores salted bcrypt hashes, and password resets go through expiring links rather than reversible copies.
Private documents stay private
Student documents, invoices, receipts and reports are served only through authenticated, permission-checked endpoints — never as public files, and never listed in sitemaps or search indexes.
Backups you can rely on
The platform includes backup management with restore points kept outside day-to-day operation, so a mistake or incident does not have to mean permanent data loss.
Out of reach of search engines by default
Authenticated areas — workspaces, student portals and administration — are excluded from the public site index and from sitemaps. Private school data is protected by access control, not merely by obscurity.
Operated with care
Dependencies are kept current, administrative access is restricted, and configuration defaults favour secure behaviour — such as production environments running with debug output disabled.
What we will never claim
We do not publish certifications, compliance badges or “bank-level” slogans we cannot substantiate. If your school has specific data-protection requirements — auditor questions, PoPIA or other regulatory reviews, or procurement policies — talk to us and we will answer factually about how the platform works.
Have a security question?
Ask us directly — we prefer an accurate answer over a marketing one.