Trust Centre · Security & privacy
Security and privacy you can see working.
Access that fits each person's work, a record of every sensitive action, and information that keeps its purpose—designed for children's data from the first screen.
Who sees what
Least privilege, in one picture
An example school's access rules. Each school sets its own; the principle never changes.
| Role | Class work and marks | Attendance | Fees | Health notes | Safeguarding records |
|---|---|---|---|---|---|
| Subject teacher | Own classes | Own classes | No access | Need-to-know | Raise a concern only |
| Office and finance | No access | Whole school | Whole school | No access | No access |
| Principal | Whole school | Whole school | Summaries | Summaries | Only if designated |
| Safeguarding lead | When relevant | Whole school | No access | Relevant cases | Full record |
| Parent | Own child | Own child | Own account | Own child | No access |
- Full access
- Limited access
- Summary only
- No access
Identity, least privilege and audit
Access that fits the task, and a record of it
Scoped identity
Access combines role, school, relationship and the action being taken—never just a job title.
Least privilege
Each role starts with the minimum it needs; sensitive actions ask you to confirm again.
Traceable action
Sensitive access, approvals and admin changes leave protected audit evidence.
Tenant separation
Every school's information is isolated by tenant, with stronger isolation available when required.
Privacy and data boundaries
Information has a purpose, a lifetime and an end
Privacy follows each record from the moment it's collected to the day it's deleted.
Purpose
Information is collected for an approved purpose, and that purpose travels with it.
Minimisation
Forms ask only for what their purpose needs. This website asks for no student data at all.
Retention
Records follow your retention schedule, with legal hold when it's needed.
Deletion evidence
When a record reaches the end of its life, its removal leaves evidence.
Support-access boundaries
When our team helps, your school can see it
Always
- Separately authorised by your school
- Limited in time
- Recorded in your audit trail
Never
- Standing access to school records
- Hidden from your administrators
How access works
Access that starts and ends with a reason
Every permission has an owner, a purpose and an end.
Request
Access is requested for a role and a purpose.
ManagerApprove
The data owner approves the narrowest access that works.
Data ownerA person decidesUse
Every sensitive view and change is recorded.
Staff memberReview
Access is reviewed on a schedule.
AdministratorA person decidesRemove
Access ends when the role ends.
Platform
Independent assurance
Security assurance, stated honestly
We publish only what is independently verified. Ask us anything your review needs.
No certification or statutory-compliance claim
We don't display certification badges or compliance claims until an independent assessment is complete.
Controls verified where they run
Encryption, recovery and operational controls are verified in your deployed environment before we describe them as in place.
Your review, answered
Send us your security questionnaire and we'll answer it as part of your evaluation.
Evaluating School Niva?
Ask the questions your review needs answered.
Security, privacy, AI or accessibility—we'll answer in writing.