Security & trust
How we protect school rota data and operate a multi-tenant SaaS platform for schools worldwide.
SchoolRota is built for schools worldwide. We treat staff rota data as sensitive operational information and apply sensible defaults for access control, audit logging, and tenant isolation.
Tenant isolation
Each customer organisation is a separate tenant. Staff, rotas, and audit events are scoped by tenant ID at the database and application layer. There is no cross-tenant data access in the shared SaaS deployment.
Multi-site organisations
MATs and federations run multiple sites within one tenant. Operational data (rotas, zones, day instances) is site-scoped; users with site-level access cannot read or publish another school's board unless they hold trust-wide roles. Client-supplied site identifiers are never trusted without server-side resolution under the authenticated tenant.
Authentication
Local email/password with bcrypt hashing. Optional SSO (OIDC) and SCIM provisioning for trusts using Entra ID, Okta, or Google Workspace. Operator and billing APIs require separate credentials and fail closed when not configured.
Cyber Essentials
Syba LLC holds Cyber Essentials certification: the UK government-backed baseline for cyber security, independently assessed through IASME. You can verify the certificate.
Hosting
Production and staging run on Fly.io in the London (lhr) region with encrypted volumes and TLS on all public endpoints. All customer data is currently held in the United Kingdom whichever country your school is in. Our sub-processors page lists every provider and its hosting location, and we update it before customer data moves to any additional region.
Backups & retention
Production data is backed up automatically on a rolling schedule to encrypted storage. Schools can export rota data at any time from the Exports area; deletion requests are handled via the school admin and our DPA, which sets out our deletion timetable.
Contact
Security questions: security@schoolrota.com