Trust Center
What actually keeps a school's data apart.
Last updated
This page describes what Shule Yangu does, in plain language, checked against the product as built rather than written as a promise. Where we have not earned a claim, we say so instead of implying it.
The short version. Every school’s records are sealed from every other school’s at the database level, and that separation is tested automatically on every change to the code — not checked by hand once a year. Money moves only when the payment provider itself confirms it, never on the strength of a request from a browser.
How one school is kept apart from another
Every query the product makes is scoped to the school the signed-in person belongs to — there is no code path that reads across schools by accident. A dedicated test suite tries to break this on every change: it signs in as staff and as a parent at two different schools and confirms that neither can reach the other’s learners, fees, messages, or documents, and that a receipt or report card cannot be opened by guessing its address. A second check reads the source of every data query in the codebase and fails the build if one is found that could read outside its own school.
How a payment is trusted
A parent’s M-Pesa prompt is generated by the school’s own paybill, through Safaricom’s own Daraja platform. Nothing is marked paid because a page said so — the ledger only accepts a payment once Safaricom’s own callback confirms it moved, and that callback is verified as genuinely coming from Safaricom before it is trusted. A prompt that is sent but never confirmed stays exactly that: sent, not paid.
What is encrypted, and what is never stored
- The site is served over HTTPS only — a plain-HTTP request is redirected, never answered.
- A school’s own credentials, such as its M-Pesa keys, are encrypted at rest and never shown back on any screen once saved.
- A push notification to a parent’s phone is encrypted before it leaves our servers, so the delivery service carrying it cannot read a child’s name or balance — only the parent’s device can decrypt it.
- Passwords and PINs are hashed, never stored as entered, and sign-in attempts are rate-limited against guessing.
Backups
The database is backed up weekly, and that backup is copied off the server it runs on rather than kept only alongside it. The system checks its own backup age continuously and would report it if a backup went stale.
What we do not claim
Shule Yangu does not hold a SOC 2, ISO 27001, or equivalent third-party security certification, and this page will not imply otherwise with a badge. Those audits are a real undertaking we have not yet gone through. If a formal certification becomes something your school specifically needs before signing, tell us — that requirement shapes what we prioritise next.
No sale, no advertising, no tracking
We do not sell data, run advertising, or track visitors across other websites. The full detail of what is collected and why is in the privacy policy.
Report a concern
If you believe you have found a security issue, write to info@relatax.org with what you found and how to reproduce it. We will acknowledge it and tell you what we did about it.
See also the privacy policy and the terms of service.