Encryption everywhere
Your data is encrypted the moment it leaves a device and stays encrypted on disk. We use AES-256 for data at rest and TLS 1.2 or higher for everything in transit, so information is protected both while it's stored and while it moves between your institution and Sala. Database backups are encrypted too, and encryption keys are rotated on a managed schedule rather than left static indefinitely.
- AES-256 at rest, TLS 1.2+ in transit
- Encrypted database backups
- Managed key rotation
Access control
People see only what their role allows — enforced on every request, not just the UI. Permissions are scoped per institution, so a teacher, an admissions officer, and an administrator each see a different slice of the system based on what their job actually requires. For institutions that need it, Sala supports single sign-on (SSO), and admin accounts carry granular, auditable roles rather than one all-or-nothing superuser login.
- Role-based permissions per institution
- Single sign-on (SSO) support
- Granular admin & audit roles
Secure infrastructure
We build on hardened, reputable cloud infrastructure with isolation between customers. Each institution's data is logically separated from every other institution's, internal systems sit behind private networks and firewalls, and our own team accesses production systems only under least-privilege rules — access is granted for a specific task, not held permanently by default.
- Logical tenant isolation
- Private networks & firewalls
- Least-privilege internal access
Monitoring & response
We watch the platform around the clock and have a plan for the day something looks wrong. Automated monitoring and alerting run 24/7, every meaningful system event is captured in centralised, tamper-evident logs, and we maintain a documented incident-response plan so a problem gets a practiced response, not an improvised one.
- 24/7 automated monitoring & alerts
- Centralised, tamper-evident logs
- Documented incident-response plan
Backups & recovery
Your records are backed up continuously, so a bad day never becomes a lost year. Backups are automated and encrypted, point-in-time recovery lets us restore data to a specific moment rather than just the last snapshot, and restore procedures are tested — not just configured and forgotten.
- Automated, encrypted backups
- Point-in-time recovery
- Tested restore procedures
Privacy by design
We collect the minimum, keep it only as long as needed, and never sell it. Data minimisation and retention limits are built into how Sala handles student records, personal data is never sold to third parties, and student data is never used to train public AI models — your institution's information stays inside your institution's environment.
- Data minimisation & retention limits
- No selling of personal data
- Student data never used to train public AI
