Whether a vendor sells or shares your data should be stated in writing, in its privacy policy and your agreement. EDUBase keeps each school's records in its own separate database; ask [email protected] for its current written privacy and data-handling terms.
What should a school software privacy policy say about selling or sharing data?
A school system holds children's names, photos, family phone numbers, fee balances, marks and staff salaries. Before signing, an owner should read the vendor's privacy policy and contract for a plain answer to one question: is any of this data sold, rented or passed to anyone for purposes other than running the school's own service?
A sound policy is specific rather than reassuring. It names the kinds of outside services that receive data, explains why each one needs it, and says what happens to the data when the school leaves.
- Whether the vendor sells, rents or trades school data, stated explicitly
- Which third parties receive data (banks, SMS and messaging services, hosting providers) and for what purpose
- Who at the vendor can access a school's data, and when (for example during onboarding or a support request)
- How long data is kept and how the school can export it or have it removed
- How the school will be told if something goes wrong
How does EDUBase keep one school's data apart from another's?
EDUBase Cloud is hosted and maintained by the EDUBase team on managed cloud servers. Every school has its own separate database, so your records are never mixed with another school's.
Staff sign in with the school's institute code, a username and password, and sessions expire. All portal and app traffic runs over HTTPS. Regular database backups are kept off the application servers, and the servers, the resolver and the messaging gateway are monitored externally with alerting.
- One database per school
- Institute code login for staff; rotating one-time code for parents
- Encrypted HTTPS connections for the portal, apps and integrations
- Attendance tablets, sender phones and gates hold their own revocable device tokens
Who inside the school can see student, fee and staff data?
Much of the real privacy risk sits inside the school: a clerk who can see salaries, or a campus that can see another campus's fee records. EDUBase lets you grant screens and actions per user, including view-only versus edit, and restrict each user to the campuses granted to them.
The User Logging page records who created, changed or deleted a record, in plain sentences with a severity badge, and a daily summary of important changes goes to the navbar bell and the Owner App. Payments, discounts, salary changes, admissions and leave can require a second person's approval.
Which outside services receive data, and who switches them on?
Some features only work if information leaves the platform: a bank must look up a challan to accept payment, and an SMS must carry the parent's number. In EDUBase these flows are chosen by the school.
- Bank fee collection is enabled per school and per bank (HBL, Bank Alfalah, Meezan Bank, PayPro and KuickPay, and through them 1Bill and 1LINK); the bank looks up the voucher by its consumer number
- SMS goes out from the school's own SIM through the free SMS Sending App, or through a branded SMS gateway the school configures in SMS Gateway Settings
- WhatsApp messages are sent from the school's own number, linked by QR code
- In-app Messages screen phone numbers and similar details before a message is stored
How do you get EDUBase's written privacy and data-handling terms?
Ask for them before you sign, and keep a copy with your agreement. Contact EDUBase Cloud (legal entity BS SOLUTIONS), 04, Babar Block Garden Town, Lahore, at [email protected] or +92 300 0148829.
Take the checklist above to that conversation, and ask in particular how support and onboarding access to your data is controlled, where your data is hosted, and how you would export it if you ever moved on.
Data security and privacy: what to ask a school software vendor
| Question to ask | What a sound answer looks like | What EDUBase states |
|---|---|---|
| Is our data sold or shared? | An explicit written statement in the privacy policy and contract | Request the current written terms from [email protected] |
| Is our data separated from other schools? | Each school isolated, not mixed in shared tables | One database per school; records never mixed with another school's |
| How do staff sign in? | Individual logins with roles and limited access | Institute code, username and password; per-user, per-screen and per-action rights with campus scope; sessions expire |
| How do parents sign in? | No shared or reused passwords | Rotating one-time code sent to the registered mobile |
| Can we see who changed records? | An audit trail the owner can read | User Logging with severity badges and a daily summary to the owner |
| Is data encrypted in transit? | Encrypted connections everywhere | Portal, apps and integrations run over HTTPS |
| Are backups kept safely? | Off-server backups, tested by restore | Regular backups kept off the application servers and periodically tested by restore |
| Which third parties receive data? | Listed, purpose-limited and controlled by the school | Bank collection enabled per school and per bank; SMS from the school's own SIM or chosen gateway; WhatsApp on the school's own number |
Related
- Cloud & Infrastructure Services — Managed hosting, one database per school, backups, monitoring and secure networking for education workloads.
- Integrations: Bank, SMS, WhatsApp & Biometric — Bank fee collection with HBL, Bank Alfalah, Meezan, PayPro and KuickPay; SMS and WhatsApp gateways; QR, biometric and face devices.
- Data Migration & Onboarding — Students, families, fee plans, old dues, past payments and staff moved from Excel or any system, verified before go-live.
- Hosting security on edubaseems.com
- Users privileges security on edubaseems.com
- Communication center on edubaseems.com
- Parents app controls on edubaseems.com
- Bank fee collection on edubaseems.com
- Sms whatsapp notifications on edubaseems.com