Security
One school's information stays its own.
School information is sensitive and it belongs to the school. That is treated as a property of how the platform is built, rather than as a setting somebody has to remember to switch on.
What the platform guarantees
Six outcomes, not six mechanisms.
Each of these is something a school can rely on without knowing how it is achieved. The machinery is not on this page because the guarantee does not depend on a reader understanding it.
One school cannot reach another
A school's information stays its own by how the platform is built, not by a setting somebody remembers to switch on. A school never has to wonder whether it can see another school's records; it cannot.
Nothing is silently overwritten
When a mark changes, the previous value, who changed it and when are preserved. A result a school has issued is preserved exactly as issued.
Access is decided per request
Every request is authorized against the role the person currently holds, and a permission withdrawn takes effect immediately rather than at the next sign-in.
Reaching a school's records is deliberate
Support access to a school's record is begun on purpose, for a stated reason, and ends when it is finished — it is not something that happens quietly in the background.
The platform is separate from the school's application
The people who run the platform sign in somewhere separate, with their own credentials, so a mistake in a school's application cannot reach the controls that administer it.
No growth at the expense of the boundary
Features arrive on the same platform. A school's record does not move, change owner, or become visible to another school for the sake of a new capability.
Isolation
One platform. No school sees another.
A school's information stays its own by how the platform is built, not by a setting somebody remembers to switch on. One deployment serves every school; each school's record is separate.
- Each school's record is its ownOne platform serves every school, and a school's information stays its own by how the platform is built rather than by a setting somebody remembers to switch on.
- Reaching a school is deliberateSupport access is begun for a stated reason and ends when the work does, and it is recorded rather than occurring quietly in the background.
- The console is a separate placeThe people who administer the platform sign in somewhere separate, with their own credentials, so a mistake in one door cannot reach the controls behind the other.
The platformidentity / provisioning / audit
School Aown record
Academic year
Marks and corrections
Published results
School Bown record
Academic year
Marks and corrections
Published results
Support access is begun on purpose, for a stated reason, and ends when the work does. It is recorded rather than quietly assumed.
A correction
The old value does not disappear.
A mark that changes is a record with two versions and a reason between them, not a value that was quietly replaced.
A mark is recorded
Marks are entered against a student, a subject and a term, and every entry names who recorded it and when.
A correction is requested
A change to an existing mark is a request with a reason rather than an edit to a value that is already in use.
The correction is reviewed
On the plans that include review, the request is approved or refused by someone other than the person who raised it.
A new version exists, and the old one stays
The previous value, the reason and the two names remain. A result already published keeps the version it was issued with.
The guarantee is about the record rather than about an interface: a reader with the right permission can establish what a mark was, who changed it and why, for as long as the year exists.
What this page will not claim
Three promises we are not making yet.
The page states what the product guarantees today, and nothing it does not. A school that needs a specific assurance before adopting should ask for it directly rather than infer it from this page.
No availability figure
An uptime percentage is a measurement, and there is not one yet. A number written before it is measured is a number a school would plan around and be let down by.
No recovery-time promise
Backups exist because a production system needs them, but a recovery-time objective is a commitment with a measurement behind it. That commitment is not being made here.
No certifications yet
Formal certifications are earned through an audit rather than announced on a page. A school that needs one before adopting should ask for it directly rather than infer it from this page.
Start here
Bring your next term onto Ashee
Start with one school. If the year closes cleanly, the rest of the group follows.