Trust & Security
Security is part of the product architecture.
OarClass handles information that schools depend on every day. Our security approach is built around controlled access, separation between institutions, secure development, careful handling of school data and clear processes for identifying and responding to security concerns.
Platform protection
Security across the OarClass platform.
Security controls work together rather than relying on one feature. OarClass combines identity, permissions, institution boundaries, application controls, infrastructure safeguards and operational processes to reduce unnecessary access and protect the systems used by schools.
Identity and access
OarClass accounts are authenticated before access is provided. Permissions are associated with user roles so administrators, teachers, students, parents and accounts teams can work within the areas relevant to their responsibilities.
School and tenant isolation
OarClass is structured around institutional boundaries. Data access is designed to remain associated with the relevant school or tenant rather than being exposed as one unrestricted platform-wide dataset.
Permission-based workflows
Sensitive administrative, academic and financial functions are intended to be available only to users whose assigned role and permissions require them.
Encrypted connections
Production web traffic is served using HTTPS/TLS to protect data travelling between supported clients and OarClass services.
Restricted production access
Access to production infrastructure and administrative systems is restricted to authorised personnel with a legitimate operational need.
Operational logging
Relevant application, security and infrastructure events may be logged to support troubleshooting, investigations and the detection of unusual or unauthorised activity.
Secure development
Security begins before code reaches production.
OarClass development uses automated validation and review processes designed to identify regressions, dependency risks and security issues before changes reach production.
Data protection
Protecting school information beyond login.
OarClass security also considers what happens after a user is authenticated: which information they can access, how data is processed, how systems are restored and how incidents are handled.
Data minimisation
OarClass aims to process the information needed to provide the selected platform functionality rather than collecting unrelated school or student information.
Backup and recovery
Backup and recovery processes are used where appropriate for production systems to support restoration after relevant technical failures or data-loss events.
Data retention and deletion
Personal information is retained according to the purposes and obligations described in our Privacy Policy, customer agreements and applicable law. Users can also follow our published data-deletion process.
Service providers
Providers that process customer data on behalf of OarClass are expected to operate under appropriate contractual and security obligations relevant to the services they provide.
Security incidents
When a confirmed security incident affects customer personal data, OarClass follows an investigation and response process and provides notifications where required by applicable law or contractual obligations.
Shared responsibility
Security also depends on how accounts are managed.
OarClass protects the platform, but schools and users also control important parts of the security model, including account access, permissions and device security.
OarClass responsibilities
Customer responsibilities
Found a security issue? Tell us responsibly.
We welcome good-faith reports of potential vulnerabilities. Please give us enough information to reproduce and investigate the issue, and avoid actions that unnecessarily expose user or school data.
Assurance & compliance
Clear about what we claim — and what we don't.
Trust center
Security is only one part of trust.
Review how OarClass handles privacy, institutional processing, acceptable use and platform availability.