Security & Compliance

How the platform is actually built and operated: where your data sits, who can reach it, and what we do and do not have in place. Where a safeguard is missing, this page says so.

AES-256At RestTLS 1.3In Transit99.9%+Uptime Target

Last updated: 1 September 2026

Infrastructure & Hosting

European Data Residency

The database, file storage and backups are hosted in the European Union, on infrastructure providers that hold ISO 27001 and SOC 2 Type II certifications. Those are their certifications, not ours. Some of the specialist services we use — payments, email delivery, error monitoring, maps — are established in the United States and receive data there in the course of their function; each one, and the transfer basis for it, is named in our privacy policy and Data Processing Agreement.

High Availability Architecture

Our database provider maintains encrypted backups on a rolling schedule, from which the service can be restored after a failure. To be precise about the limits: we are on a plan without point-in-time recovery, so restoration is to a backup point rather than to an arbitrary moment, and we do not operate multi-zone automatic failover. We publish uptime targets per plan in our service-level statement; they are targets we work toward, not a measured guarantee.

Content Delivery

Static assets and public school profiles are served through a global edge network for fast load times worldwide, while all dynamic data processing and storage remains within European infrastructure boundaries.

Encryption

Data in Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.3 with modern cipher suites. We enforce HTTPS across all endpoints and implement HTTP Strict Transport Security (HSTS) with a minimum 1-year duration.

Data at Rest

All data stored in our managed Postgres database is encrypted at rest using AES-256, provided by our infrastructure providers (Supabase on AWS). Backup snapshots are encrypted under the same scheme. Key management is handled by those providers at the platform level; we neither hold nor rotate the keys ourselves.

Sensitive Data Handling

Authentication credentials are hashed using bcrypt with appropriate cost factors. API keys are hashed with SHA-256 before storage — we cannot recover the plaintext, only verify it on use. Webhook signing secrets and OAuth refresh tokens are stored in our managed Postgres database, encrypted at rest by our infrastructure providers. Payment card data is never stored on our servers — it is handled entirely by Stripe (PCI DSS Level 1 certified).

Access Controls

Role-Based Access Control (RBAC)

Access within a school follows the role assigned to each team member. Three roles are in use: Owner, held by one person per school and transferred rather than granted; Admin, a full co-manager who can do everything except change who else is an admin or transfer ownership; and Editor, for content and day-to-day work. Permissions are enforced twice — in the server actions and again in the database — because a server action is a public endpoint and hiding a button is not preventing it.

Row Level Security (RLS)

The database implements PostgreSQL Row Level Security, so every query is filtered at the database level rather than by application code. A school can only reach its own inquiries, bookings, analytics and settings — and that isolation holds even if application code is defective, which is the reason it is done there and not in the query layer.

Authentication Security

We support email/password authentication with enforced password policies, magic link authentication for passwordless access, and team invitation flows with secure token-based verification. All sessions use short-lived JWT tokens with automatic refresh.

Audit & Monitoring

Activity Logging

Significant platform actions are written to an audit log: authentication events, administrative operations, support access to a school's dashboard, and changes to accounts. The log is not writable or readable by any user account — a database policy blocks every non-service-role access to it — and entries are not pruned, so the record persists rather than expiring on a schedule.

Real-Time Monitoring

Our infrastructure is continuously monitored for performance, availability, and security anomalies. Automated alerts trigger our incident response process for any detected irregularities, including unusual access patterns or potential security threats.

Legal Framework

Swiss Federal Act on Data Protection (FADP)

Swiss Private Schools is built to align with the revised Swiss Federal Act on Data Protection (nFADP/revFADP), in force since 1 September 2023. We apply privacy-by-design and data-minimisation, encrypt personal data in transit and at rest, and restrict access on a need-to-know basis. We have not carried out a formal data protection impact assessment; whether one is required for the platform's processing of children's and health-related data is a question currently with external counsel.

EU General Data Protection Regulation (GDPR)

We align our processing of EU residents' personal data with the GDPR. This includes honoring data subject rights (access, rectification, erasure, and portability), maintaining a lawful basis for processing, and applying data protection by design and by default.

What we do not hold

We hold no ISO 27001, SOC 2 or equivalent certification of our own, we do not commission external penetration tests on a schedule, and we run no formal periodic review of our sub-processors. Our infrastructure providers hold those certifications; we do not, and we would rather you knew that than inferred otherwise from the certifications above. Our own assurance rests on the architectural measures on this page, on automated tests that run before every deployment, and on continuous error monitoring. If your procurement requires a certified processor, tell us before you subscribe.

Incident Response

Response Process

The platform is monitored continuously and alerts reach us automatically. We are a small operation, so we do not promise a detection or containment time: what we commit to is that an incident affecting service or data becomes the priority of the day, ahead of any feature work, and that you hear from us while it is still being worked on rather than afterwards.

Notification Commitment

In the event of a data breach affecting your institution, we will notify you within 72 hours of confirmation, consistent with FADP and GDPR requirements. Notifications include the nature and scope of the breach, actions taken, and recommendations for your own notification obligations.

Continuous Improvement

Every security incident is reviewed afterwards, and what we learn goes back into the controls, the threat model and the monitoring. We do not currently publish a periodic transparency report; if you are affected by an incident you will hear about it directly, and any school may ask us what has happened over a given period.

Responsible Disclosure

Security Research

We welcome responsible security research. If you discover a potential vulnerability, please report it to security@swissprivate-schools.ch. We commit to acknowledging reports within 24 hours and providing an initial assessment within 5 business days.

Safe Harbor

We will not pursue legal action against security researchers who act in good faith, follow responsible disclosure practices, and give us reasonable time to address reported vulnerabilities before public disclosure.

EU-Hosted Infrastructure, Swiss Governance

Swiss Private Schools is committed to the highest standards of data security and privacy. All personal data is processed within European infrastructure with EU data residency (Frankfurt), protected by Swiss and EU data protection laws.

Our security practices are regularly reviewed and updated to address evolving threats and regulatory requirements. For security inquiries, contact our team at security@swissprivate-schools.ch.