Security and Trust

In short. Cloud infrastructure in the United States and the European Union. Encrypted in transit and at rest. There is no Liberian data-centre option from our providers today.

SchoolPort runs on Supabase (PostgreSQL database, authentication, file storage, and server functions) hosted in the United States and the European Union. The staff web portal is served from Vercel. The BLUE app for parents and students is delivered through the Apple and Google stores, with over-the-air updates via Expo.

There is no Liberian data-centre option available from these providers today. Transfer safeguards and the vendor list (sub-processors) are in our Privacy Policy.

In short. Only accounts your school issues, limited by role. Isolation is enforced in the database, not only on the screen.

Every student, grade, attendance, and fee row belongs to one school. Teachers see their own classes; parents see linked children; school administrators see their institution. District and national officials see only what their role allows.

That split is enforced by row-level security inside PostgreSQL — hundreds of policies that refuse the wrong school even if a screen forgets to filter. SchoolPort staff do not browse school records as part of ordinary work.

In short. TLS in transit, encryption at rest, hashed passwords, optional authenticator-app MFA for staff, encrypted storage on the phone.

Data is encrypted in transit (TLS) and at rest on the database and file storage. Staff and family passwords are stored as cryptographic hashes, not readable text. School administrators can use an authenticator app for two-factor sign-in. The BLUE app keeps sessions and offline drafts in encrypted on-device storage, cleared on sign-out.

In short. We are enabling point-in-time recovery on the production database and testing a restore before real school records depend on it. We will not claim a backup we have not restored.

Hosting already encrypts data at rest. Point-in-time recovery on the production database is the remaining operational step: turn it on with our host, confirm the retention window, and perform a test restore into a spare project. Until that restore has been done once, we treat backups as incomplete and we say so here.

Copies we control expire on a rolling schedule (at most 35 days), as stated in the Privacy Policy retention section. Schools can export their own records at any time.

In short. Kate is off until a parent uses her. Questions and linked children’s relevant records then go to OpenAI under contracts that forbid training on that data.

Everything else in SchoolPort works without Kate. If a parent asks her a question, that question and the linked children’s relevant records are sent to generate the reply. Do not want that? Do not use Kate. Details are in the Privacy Policy (section 5).

In short. No advertising SDKs, no sale of data, no public social network.

The product contains no advertising or third-party analytics SDKs. The only third-party code on the staff web portal is error monitoring (Sentry), set up so that personal text, cookies and request contents are not collected. We do not sell personal data. Communication stays inside a school community. Public-site conversion events (page path and event name only) wait for cookie consent, honour Do Not Track, and are not used in BLUE, the student and parent app.

In short. Schools own their records and SchoolPort processes them on the school’s instructions. We collect only what running a school requires and never sell it.

• Roles. For official school records (enrollment, grades, attendance, fees) the school decides what is kept and for how long, and SchoolPort acts as its processor. For parent accounts, messages and consent records, SchoolPort is the controller.
• Purpose. Data is used to run the school service. It is not sold, not used for advertising and not used to profile children.
• Access. Limited by role and enforced inside the database, so one school can never read another’s records.
• Children. Student accounts are issued by the school. Additional limits apply to students under 16 and are enforced on our servers.
• Your rights. Download, correct or delete your data, object, or withdraw consent. Requests are answered within 30 days at no charge.
• Law. Liberia enacted a Data Protection Act on 19 August 2026 and its regulations are still being established. We are assessing our practices against it and the ECOWAS Supplementary Act, and will update our policies as the framework takes effect.

The full wording is in the Privacy Policy and Terms of Service.

In short. The outside providers that handle data for us, what each does and what data it sees. Schools get 30 days’ notice before we add one.

Supabase

Database, authentication, file storage and server functions. Where SchoolPort’s data lives. Data involved: All platform data, hosted in the United States and the European Union.

Vercel

Serves the staff web portal and the public website. Data involved: Page requests (IP address and browser details) while pages are delivered.

Sentry

Error monitoring for the staff web portal, so faults are found and fixed. Data involved: Technical error details and page paths without query strings. Cookies, request headers and bodies, and user identity are not collected, and any session recordings mask all text and block images.

Cloudflare (Turnstile)

Anti-bot check on public forms (school registration, contact and demo requests). Data involved: The visitor’s IP address and browser signals during the check; the form content is not sent to Cloudflare.

Expo

Push-notification delivery and app updates. Data involved: Push token and notification text.

Google Firebase

SMS-code sign-in for parents. Data involved: The parent’s phone number while the code is sent and checked.

Twilio

Sends account and enrollment text messages (for example activation codes and enrollment decisions). Data involved: The recipient’s phone number and the message text.

Resend

Sends account and notification emails. Data involved: The recipient’s email address and the message content.

OpenAI

Powers the optional Kate assistant. Not used unless a parent uses Kate. Data involved: The parent’s question and the relevant records of their linked children.

Each provider is bound by a written agreement that allows processing only on our instructions. To be told when the list changes, ask your school administrator to email support@schoolportsis.com.

In short. Nothing is kept forever. These are the periods for data we control; a school’s academic records follow the school’s own rules.

Parent account

Until you delete it, or 24 months after your last sign-in.

Push tokens

Deleted when you sign out or disable notifications.

Kate chat history

Clearable in BLUE at any time; kept no longer than 12 months.

In-app notifications

12 months.

Support messages

24 months after the matter closes.

Security & audit logs

12 months; administrative audit trails 365 days.

Abuse reports

24 months after resolution.

Backups

Rolling expiry of no more than 35 days.

Official academic records belong to the school. If a school stops using SchoolPort, we delete its records within 90 days unless the law requires us to keep them. See section 10 of the Privacy Policy for the full statement.

In short. If a breach is likely to put people at risk, we tell the affected schools and account holders without undue delay. Report a suspected incident to the contact below.

Security incidents: security@schoolportsis.com. Child-safety reports: support@schoolportsis.com, handled first. Please include what you saw, when, and which school or account is involved.

If personal data is affected, we notify the affected schools and account holders without undue delay, explain what happened and what we are doing about it, and notify the supervisory authority where the law requires. Service disruptions are published on the system status page.

In short. Found a security weakness? Email us privately. Good-faith research that follows these rules will not be pursued.

Email security@schoolportsis.com with “Security” in the subject. Please include the affected page or function, the steps to reproduce, and what you were able to see or do. Our machine-readable contact is at /.well-known/security.txt.

Please: report privately and give us reasonable time to fix the issue before sharing it; use only your own accounts and test data; stop as soon as you reach another person’s data and tell us.

Please do not: read, change or delete data that is not yours; disrupt the service (no denial-of-service or heavy automated scanning); use social engineering or physical attacks; or contact students, parents or staff.

We will confirm we received your report, keep you informed, and credit you if you want to be named. We do not run a paid bounty programme at this time. If you follow these rules we will treat your research as authorised and will not take legal action against you.

In short. Live status at /status. Security reports: security@schoolportsis.com.

Platform health is published on the system status page. For any other question about how we protect data, write to support@schoolportsis.com. To report a security problem, use security@schoolportsis.com. See also Child Safety Standards.