Security & privacy
Nothing is open by default. From the day your school is created, anyone opening a sensitive record has to say why.
Default settings
strict_baseline_v1There is no school without these settings. They are attached the moment the school is created, so nobody has to remember to switch them on.
While settings are being changed, the stricter of the two stays in force.
Every school in its own lane
Same person. What she can see comes only from her job at Instituto Horizonte, and these records stay separate from every other school's.
Picking a school here only changes what you're looking at. It never grants access: what someone can open depends on the job they hold and the family they belong to.
An example of how this works. Not real school data.
Opening a sensitive record
Pick an outcome. The record below changes with it, and the log keeps both either way.
The reason is picked from a set list before anything is shown. Sensitive records are never loaded in advance, and never follow you from one student to the next.
Opening a health record
Allowed — a reason was given
Reason given: safeguarding review · kept for as long as your school's settings say
Each line says who looked, at which school, at whose record, what kind of record it was, the reason they gave and the exact time. Lines are only ever added — never changed, never removed.
Guardians see exactly what they should
Access follows a registered guardian link — not a shared surname and not a shared password.
Registered guardian
Can see
Never sees
An example of how this works. Not real school data.
When a family asks about their data
Written down: deleted · what was covered, and when it finished.
Who takes care of what
This page describes how the software behaves. It is not a certificate, an audit or a legal guarantee — what your school is obliged to do comes from your own country's rules and from how your system is set up.