Data protection
Security
How a school's records are kept apart, encrypted and accounted for.
Last updated 31 October 2026
Security
Built to protect pupils. Easy for staff.
Children's records need the highest level of care. REO360 makes sure every person sees what their role requires, and nothing more.
Hosted in India
All records and backups stay in Indian data centres.
Your own database
Each school gets a separate database, so no school can ever see another's data.
Access by role
Teachers, accountants and parents see only what their role permits.
A full audit trail
Every mark, approval, publish and download is logged and visible to the school.
Password-free for parents
Families log in with a one-time code sent to their registered mobile.
Nightly backups
Every backup is checked the moment it's made.
1. Data residency
School records, uploaded files, backups and server logs are held in Amazon Web Services' Mumbai region. Push notifications and mobile app crash reports pass through Google Firebase, which may process them outside India. Our Privacy Policy has the detail.
2. Isolation between schools
Each school's records live in their own database. On top of that, every table carries the school identifier and enforces row-level security, and the application connects with a role that cannot bypass it.
Isolation is tested per table in the build: for every tenant-scoped table there is a test asserting that school B can neither read nor write school A's rows.
3. Encryption
All traffic is encrypted with TLS. Stored files and backups are encrypted at rest, and medical notes and counselling records are additionally encrypted field by field, so a database dump alone does not disclose them.
Passwords and PINs are hashed with argon2id. One-time codes are stored only as an HMAC.
4. Who can see what
Authorisation is a permission and a scope, checked together on every request. A subject teacher sees the sections they teach; a class teacher sees their class; a guardian sees the children linked to them and only the categories the school allowed; a pupil sees themselves.
Administrative, principal and finance contexts require a separate PIN check before they open.
5. Audit and accountability
Every change to a school record and every download of an export is written to an append-only audit log with the person, the context and the time. Financial records are never edited in place.
6. Certifications
REO360 does not yet hold an independent security certification such as ISO 27001 or SOC 2. We will publish the details here when that changes.
7. Reporting a vulnerability
Write to security@reo360.in with the detail needed to reproduce the issue. We acknowledge within one working day and will not pursue anyone who reports in good faith.
See REO360 running on your own school's data
A 30-minute demo with your timetable, fee structure and one section of pupils already loaded. No commitment, no card needed.
