ClassNest

Security and privacy

Your data, kept apart

A madrassah holds information about children and families. Here is how ClassNest looks after it, in plain English.

Every madrassah is sealed off by the database

Every record in ClassNest belongs to one madrassah, and the database itself checks every request against it (this is called row-level security). It isn't left to the app to hide things: if a screen had a mistake in it, the database would still refuse to hand over another madrassah's records.

  • A second check shuts a madrassah's records completely while it is paused, waiting for approval or closed.
  • Automated tests sign in as each kind of user at one madrassah and check that nothing from another madrassah can be seen or changed. They fail if anything new is added without these protections.
  • The same applies to files, live updates, notifications and reports, not just records.
  • A paused madrassah can't be used by anyone, but its data is kept safe.

Stored in the UK

Records, accounts and uploaded files
Supabase, in London (UK).
Our nightly backup copy
Encrypted, then kept in Cloudflare R2, in the EU.
On-site plan
On the computer in your building. About on-site.

Notifications to phones pass through Apple and Google (and Expo, the service the app uses to send them), which are based in the USA, so we keep the text of notifications short.

Protected at every step

  • Encrypted

    Everything travels over encrypted connections, and is encrypted where it is stored, including backups. On-site computers use full-disk encryption.

  • Strong sign-in

    Two-step sign-in (MFA) is always required for everyone who runs the platform, and offered to headmasters. Five wrong passwords in 15 minutes lock sign-in with that mobile number for 15 minutes. On on-site servers they lock the account itself, however it signs in. On the cloud, sign-ins by email are limited to 30 attempts every 5 minutes from each network address.

  • Backed up every night

    Supabase backs up the database every day. We also take our own encrypted copy every night and keep it with Cloudflare in the EU, so a problem at one provider never takes your data with it. We practise restoring from these backups.

When we look inside your madrassah, you know about it

To run the service we need to see some figures, and sometimes to help with a problem. This is exactly what we can see, and how it is recorded.

Our three levels of access
Level What we can see When What is recorded
Everyday figures Totals only: numbers of pupils and staff, attendance rate, fees collected, messages sent, last activity. No names or personal details. Always Nothing personal is shown, so there is nothing to record.
Support view (read only) What your headmaster sees, so we can help with a problem. Only with a reason, which we record. It ends after 2 hours. Your headmaster is notified, and every screen we open is logged, in our log and in your madrassah's own. What we read is recorded by the database itself.
Acting as headmaster The same, and we can make changes for you. Only after a second confirmation. It ends after 30 minutes. Every change, under our name, in both logs.

There is no silent access. Without an open support session we can't see inside your madrassah at all, so a stolen password alone can't quietly expose children's information. Everyone who runs the platform is emailed whenever one of our accounts signs in from a new device or network, is locked by wrong passwords, or changes a security setting, and when support is used at night or more than usual.

UK GDPR: you stay in control

  • Your madrassah is the data controller; we are your data processor and only use your data to provide ClassNest to you.
  • We sign a data processing agreement (UK GDPR Article 28) with every madrassah. It covers support access, as described above.
  • We publish the list of companies that help us run ClassNest (our sub-processors), with what each one holds and where. See our legal documents.
  • If something goes wrong, we tell you quickly, so you can report it to the ICO within 72 hours where you need to.
  • When you leave, we can give you a full export, and we delete your data 12 months later, or sooner if you ask.
  • No adverts, no analytics and no AI training on your madrassah's data. We never sell it.

Built with safeguarding in mind

Messages between parents and teachers are a permanent, audited record. They can't be deleted, the headmaster can read any conversation, and every time they do it is written to the audit log. Teachers never need to give parents their personal phone number.

What we're working towards

We'd rather tell you what we haven't done yet than claim it. Planned, but not yet held:

  • Cyber Essentials certification.
  • An independent penetration test.

This website has no cookies, no analytics and no trackers, and doesn't load anything from other sites.

Questions from your committee or your data protection lead? We're happy to answer them.