Security and privacy
How PeopleCampus protects school data. PeopleCampus does not currently claim any third-party security certification.
- Tenant isolation in the database
- Every record carries its institution, and the database applies row-level security so a query can only return the signed-in user's institution's rows. Cross-institution references are rejected by the schema itself.
- Membership, not just sign-in
- Signing in proves who you are. What you can see comes from an active membership and role at a specific institution, and campus access can be narrower.
- Separation of duties
- Grade approval, billing adjustments, refunds, payment reversals and record corrections require a different person to approve than the one who prepared them.
- Audit trail
- Changes to sensitive records are written to an append-only audit log with before and after values.
- Support access
- PeopleCampus staff can view a school's data only through a time-limited grant (at most 72 hours) that the school can see, and every use is logged.
- Private content is never publicly cached
- Pages and APIs with student or financial information are served with private, no-store caching.
- Payments
- Amounts are stored as whole centavos. Online payments count only after verification from the payment provider or a cashier; a screenshot or redirect is not proof of payment.
- Devices
- Attendance readers sign each request with their own secret, which is stored encrypted and can be rotated. PeopleCampus does not store fingerprint or face templates.
- Environments
- Development, demo and production are separate, with separate databases and secrets. The demo contains only fictional data and cannot send real messages or take real payments.