Security
Built to protect student records
Student data is sensitive and regulated. Academywise enforces access in the database itself, keeps privileged work on the server, and records what happens.
Access control
- Row-level security policies on every database table, enforced by PostgreSQL
- Eleven roles stored server-side, never in browser storage, plus independent add-on roles for payments and compliance
- Trainers see only their own classes and students; agents only their own agency's students; students only their own record
- Database triggers prevent privilege escalation and removing the last administrator
Application security
- Privileged operations run on the server only after the caller's role is verified
- Students have no direct database access; the portal uses server functions tied to the student's own record
- Incoming payment and lead webhooks are verified by signature; scheduled jobs require a secret
- Secrets live in the hosting secret store, never in code
Secure links & verification
- Single-purpose pages (document uploads, offer signing, references, placement hours) use unguessable tokens
- The public payment page verifies student ID and date of birth, then issues an HMAC-signed payer token
- Contact-change codes are hashed, expire after 10 minutes and are rate-limited
- Payment ledger rows are written only after the payment processor confirms
Audit & accountability
- Application, agent and compliance events recorded as they happen
- Every AVETMISS export and data migration batch is logged
- Staff "log in as student" or agent sessions are restricted to admins and logged
- Communication log edits by super admins keep the original value
Transparency
What we don't claim
Academywise doesn't currently hold third-party security certifications such as ISO 27001 or SOC 2, and we don't claim any. If certifications are added in future, they'll be listed here with their scope.
Hosting region, data residency, backup and incident-response details depend on your deployment and agreement. We'll provide them in writing during evaluation. Ask us for our security documentation as part of your procurement process.
To report a security concern, please contact us and mark it as security-related.
Questions from your IT or procurement team?
We'll walk your technical team through the access model, integrations and data handling.
- Walkthrough tailored to your modules
- Discuss migration from your current system
- Clear status on every feature