Request your school

Security

Built to hold a school’s records.

Yamoreh holds sensitive information about students and staff, so security is the foundation rather than a feature. This page is the plain-language version; the technical overview, the FERPA and COPPA checklist and the list of service providers are available on request.

  • Two-factor sign-in

    Every account needs a password and a one-time code. Codes expire in minutes, are single-use, and are stored only as digests.

  • One wall per school

    Each school’s data is isolated from every other school’s by the database itself, on every table, not by a filter a developer has to remember.

  • Encrypted where it matters

    Traffic and storage are encrypted, and the most sensitive fields are encrypted again before they are stored.

  • Every look, recorded

    Opening contact details, family relationships, documents or case notes writes an audit event: who, what, when. Administrators can read the log.

1Who sees what

Access is by role, and each kind of sensitive information (contact details, family relationships, documents, case notes) is its own, separate permission. A teacher sees the students in their own classes, their names and enrollment status, and not their home addresses, family contacts, medical notes or documents. Seeing a name on a class list does not unlock that student’s private details. Families and students see only their own information.

These rules are enforced on the server, not by hiding buttons in the app, so they hold even when someone goes around the normal screens.

2Joining by invitation

Nobody creates a staff account on their own. Members join by invitation from an administrator; students’ accounts are created from their approved application and invited. Invitations expire, are single-use, and are revocable.

3Where it runs

The application, its database, file storage and background work run on managed infrastructure in the United States, on a small number of providers that are named in the list we give every school. Backups are taken automatically and a restore has been drilled, not just planned. Whether each part is up right now is on the status page.

4Compliance

Yamoreh is built for FERPA. The written checklist (what is collected, who may see it, how it is protected, how a family exercises its rights) is maintained alongside the code, together with an incident response runbook and a backup and restore drill. Schools with students under thirteen get the COPPA checklist too.

5Reporting a problem

If you believe you have found a security issue, write to us from the contact page. We acknowledge within one business day and keep you informed until it is resolved.