Klavenn holds student records, tuition payments and a school’s official documents. That responsibility shapes how the platform is built: security is not a module bolted on at the end, it is one of the foundations.
Strong authentication
Passwords hashed with bcrypt, signed JWT sessions, first login forced to change the temporary password.
Multi-tenant isolation
Every school has its own logically isolated space. Queries are indexed on the tenant identifier without exception.
End-to-end encryption
TLS 1.3 in transit for every request, encryption of sensitive data at rest via the database engine.
Complete audit log
Every sensitive action (account creation, payment, record deletion) is traced with actor, timestamp and metadata.
01Hosting and infrastructure
Klavenn is hosted on cloud infrastructure that meets international best practices (ISO 27001 / SOC 2 certified data centers). Critical components (database, storage, server functions) are deployed for high availability.
No part of the platform runs on user machines or personal drives. Server access is restricted to a small number of engineers and is logged.
02Encryption
All requests between your browsers / phones and our servers are encrypted with TLS 1.3. Certificates are renewed automatically.
Data at rest (databases, backups, uploaded files) is encrypted by the storage engine. Passwords are never stored in plain text: they are hashed with bcrypt (cost ≥ 10) before being written.
03Authentication and access
User accounts are created by the school administration. On first sign-in the user is required to change the temporary password they were given. Sessions rely on signed, time-limited tokens (JWT).
Permissions are role-based (RBAC): a teacher can only see their own classes, a parent only their own children, and so on.
04Backups and continuity
Databases are backed up automatically every day, retained for at least 7 days on standard plans and 30 days on Enterprise. Restores are carried out by our on-call team in the event of a major incident.
05Updates and patches
Security patches to our dependencies are applied within 7 days for critical vulnerabilities and 30 days for high-severity ones. Platform updates ship without visible interruption for the School.
06Logging
Every sensitive action (creating an account, deleting a record, a payment, access to restricted data) is written to a timestamped audit log that remains available to the school administration. That log is immutable and kept for at least 12 months.
07Reporting a vulnerability
Found a vulnerability?
Write to security@klavenn.com with a detailed description and, if possible, a proof of concept. We acknowledge receipt within 24 business hours and work with you until it is fixed.
We do not pursue good-faith researchers who follow responsible disclosure.
08Compliance
We follow OWASP best practice (Top 10) and are working towards recognised certifications. Details of our compliance posture can be shared with Enterprise schools on request.