Security
Built to keep children's records safe.
An institution trusts us with information about children, families and money. Here is how the product protects it, in plain words.
Each institution's data is kept apart inside the database
Every record belongs to one institution, and PostgreSQL row-level security checks every read and write against the signed-in person's institution, campus and role. This holds even if application code has a mistake, and it's covered by automated tests that try to read and change other institutions' data.
People see only what their role allows
Teachers see only the classes they teach. Campus administrators see only their campus. Parents see only their own children, and only results that have been published. Permissions are checked on the server, not just hidden in the interface.
Sign-in
Passwords are hashed by a well-established authentication library, email addresses are verified, and repeated failed sign-ins are slowed down. Two-step sign-in with an authenticator app is available to everyone, and an institution can require it for chosen roles. You can see every device you're signed in on and sign any of them out.
Money is handled carefully
Amounts are stored as exact whole paisa, never rounded decimals. Payments and invoices are never deleted or edited: corrections are recorded as separate entries with a reason, and a retried payment can't be recorded twice.
A record of changes
Important actions (enrolments, marks after publishing, payments, role changes and more) are kept in an activity log with who did what and when.
Our own staff
CrestVibe staff can see account details and usage counts in order to run the service. They cannot open your students' or staff records.
Backups
Backups are part of running the service, and restoring one is rehearsed with a script that checks the restored copy matches the original, row for row.
If your subscription ends
Nothing is deleted. The account becomes read-only until it's renewed. Requests to export or delete an institution's data are handled by us on request.
We don't claim any certification. To report a security problem, email us; we reply to every report.
Make space for
what matters.
A 30-minute walkthrough, set up with your institution’s structure.