Children's records.
We treat them like it.
This page is written for the person at your school who has to be satisfied before you sign — and it is specific enough to be checked.
One school cannot read another.
The database refuses.
The usual way to build multi-tenant software is to add "where school = ours" to every query and hope nobody forgets. We don't rely on remembering.
How it actually works
Every request carries an identity established at sign-in. Before a single row is read, the connection is told which school it is acting for — for that one transaction only, never for the connection as a whole, so a pooled connection cannot carry one school's context into the next request.
Postgres row-level security then filters every table, in the database itself. A query written by a careless developer for "all students" returns only that school's students, because the database will not hand over anything else. The same policies constrain a parent to their own children and a class teacher to their own sections.
The places we deliberately cross
A handful of operations must see across schools — signing you in, sending an email, our own admin console. Every one of them is declared in a list, in code, with a written reason, and the build fails if somebody adds another without writing its sentence.
Handing out access asks again
Changing who holds which role, editing what a role means, or inviting a member re-prompts for the password even if you signed in an hour ago. It lasts ten minutes. Ordinary work — verifying a payment, marking a register — never prompts, because a prompt people see all day is a prompt they learn to type through.
A backup nobody has
restored is a rumour.
So we restore one, on a schedule, into a clean environment, and check that a named student's fee history comes back byte for byte.
Nightly, encrypted
Full database dump, encrypted at rest, written to storage in a second region.
30 days rolling
Plus a monthly snapshot kept for a year, so a mistake found in March is still recoverable.
Quarterly restore
Restored into an empty environment and verified against known records. Trust-plan schools can witness it.
Export, any time
Full CSV of every module, run by you, without asking us. The best backup is one we don't hold.
What we store
Names, dates of birth, admission numbers, class and section, attendance, marks, conduct notes, fee records and guardian contact details. Payment proof a parent uploads — a UPI screenshot, an NEFT advice — is stored so your office can verify it, and deleted with the rest of the record.
What we never do
We do not sell data. We do not run advertising. We do not train models on your students. We do not give a third party access to a school's records unless your school has appointed them and told us so in writing.
Who at Timelino can see it
Support access to a school's live data is off by default, requires the school to turn it on, is limited to a named person, expires after 24 hours, and is written to a log the school can read. We cannot silently look at your records.
If something goes wrong
You hear from us within 24 hours of us confirming an incident that touches your data — by phone to the account holder, then in writing, with what happened, what was reached, and what we did. Before the fix is finished, not after.
The complete list.
| Who | What for | Where |
|---|---|---|
| Hetzner | Servers and database | India |
| Cloudflare | DNS, CDN and static hosting | Global edge |
| Backblaze B2 | Encrypted backups | India |
| Resend | Transactional email | EU / US |
Scroll sideways for where each one runs.
Email carries a parent's name and address only — never marks, fees or attendance. We tell you before this list changes, not after.
Your school is the Data Fiduciary; Timelino is a Data Processor acting on your instructions. Our agreement says so in those words, and includes consent handling for children's data. Ask for it before you sign — we'd rather you read it.
Send us your IT advisor's questions.
Architecture notes, the sub-processor list, the DPA and our incident policy — as documents, not as a sales call.