Confidentiality

Every page and every action resolves which school the person signing in belongs to, and reads only that school’s records. It is checked on each request rather than remembered, so a login that is removed from a school stops reaching it immediately rather than when its session happens to expire.

Somebody who works at two schools — a director of a small group, say — switches between them deliberately and sees one at a time.

Roles are coarse on purpose. These are small teams, and an elaborate permissions scheme would only be worked around. What matters is that the divisions that count are real:

PlanWise support staff belong to no school. The console they use lists the schools on the platform, each one’s plan, learner cap, subscription status and SMS balance, and the accounts of the people who administer it — enough to enrol a school, change what it has bought, and reset an administrator’s password when they are locked out.

It does not open a school’s learners, fees, attendance or messages. Those pages resolve a school membership before they show anything, and platform staff have none, so they are turned away by the same check that keeps one school out of another’s records.

What we will not claim: that we are incapable of reading a school’s data. We operate the database it sits in. The honest statement is that the product gives us no way in, that we do not do it, and that we do not use anyone’s records for our own purposes — not to sell, not to advertise against, and not to train models.

Passwords are stored only as a hash and cannot be read back by anyone, including us. Changing your own password signs out every other browser you were signed in on, and a password reset by an administrator ends all of them.

There is no self-service password reset. A password is issued by whoever is above you and replaced the first time you use it, because anyone able to guess an email address could otherwise lock a school’s administrator out of their own system.

A school’s M-Pesa API credentials are encrypted before storage and are never sent to a browser, encrypted or not.

Most of what protects these records is not technical. The parts that are the school’s:

• One login per person, never shared. A shared login makes every record in this list readable by whoever is at the desk, and makes “who did this?” unanswerable.
• Give people the role that matches the job. A teacher given an administrator account can see every family’s fees.
• Disable the login when somebody leaves, the same day. It is one action on the staff page.
• Tell parents what you hold about their children. That notice is the school’s to give, not ours.

If you think an account has been used by someone it does not belong to, change that password first — it ends every other session on it — and then tell us at hello@planwise.co.ke. Tell us what you saw and when. We would rather look at ten false alarms than hear about a real one late.