Architecture

SchoolKit's security model is built on architecture, not promises. Every tool runs entirely in your browser using client-side JavaScript. The data you enter — student names, attendance records, exam schedules, fee amounts — never leaves your device. There is no SchoolKit server that stores your school records.

What We Protect

Tool Data

Processed locally in your browser. Stored in localStorage (optional). Never transmitted to our servers.

Community Data

Votes, opinions, and country data stored server-side. Pseudonymous — linked to a device fingerprint, not your identity.

Encryption in Transit

Our website is served exclusively over HTTPS (TLS 1.2+). All communication between your browser and our servers — including community votes, opinions, and analytics — is encrypted in transit.

Content Security Policy

We implement Content Security Policy (CSP) headers to restrict which scripts, styles, and resources can load on our pages. This reduces the risk of cross-site scripting (XSS) attacks and unauthorized third-party code execution.

Dependency Management

We regularly audit our dependencies for known vulnerabilities. Our build process includes automated security checks, and we keep all packages up to date. When vulnerabilities are disclosed in dependencies we use, we patch promptly.

Vulnerability Reporting

We welcome responsible disclosure of security vulnerabilities. If you discover a security issue, please email us at [email protected] with a description of the issue. We will investigate within 24 hours and keep you informed of our progress.

Incident Response

In the event of a security incident affecting our infrastructure, we will notify users via a notice on our website. Because SchoolKit does not store tool-entered school records on our servers, a breach of our infrastructure would not expose student data, attendance records, or other school information entered into our tools.

Third-Party Services

We use a minimal set of third-party services, each carefully chosen:

Google Analytics — Anonymized usage analytics with IP masking. No personal data collected.
Google Fonts — Typography. May log CSS/font requests.
OpenStreetMap — Map tiles for the Bus Route Planner. IP visible in tile requests.

We do not use social media widgets, chatbots, or other embedded content that could track users.

What We Don't Guarantee

We are honest about our limitations. We do not guarantee:

Zero downtime — our hosting infrastructure may experience outages
Complete absence of vulnerabilities — no software is perfect
Compliance with every jurisdiction — schools should assess their own obligations
Protection of data in your browser — if your device is compromised, your data may be at risk

Our security model is designed to minimize risk through architecture. We believe this is the strongest approach available for a free, open tool.