Security
How we protect your school's data
Encryption
In Transit: All data is encrypted using TLS 1.3. Every connection to Decimal is HTTPS-only with HSTS enforcement.
At Rest: All data is stored in Supabase (PostgreSQL) with encryption at rest using AES-256.
Offline Data: Local data cached on devices uses browser-level encryption via IndexedDB. Data is cleared on logout.
Authentication
Google OAuth: We use Google for authentication. Decimal never stores passwords — your credentials are handled entirely by Google.
Session Management: Sessions are managed by Supabase Auth with secure, HTTP-only cookies.
Captcha: Cloudflare Turnstile protects against automated attacks during login.
Authorization & Access Control
Role-Based Access Control: Every user is assigned a role (Principal, Teacher, Finance, etc.) that determines what they can see and do.
Row-Level Security: Supabase RLS policies ensure users can only access data from their own school. Teachers see their classes, principals see their school, super admins see everything.
School Isolation: Data is completely isolated between schools. No school can access another school's data.
Audit Logging
All data modifications are logged with timestamps, user IDs, and the type of change. Audit logs are immutable and accessible to super administrators for compliance and incident investigation.
Data Residency
All data is stored in Supabase's EU (Frankfurt, Germany) region. Supabase is SOC 2 Type II certified and GDPR compliant. Data is not transferred outside the EU without explicit consent.
Incident Response
Detection: We monitor for unauthorized access, data breaches, and system anomalies using automated alerting.
Response Time: Security incidents are triaged within 24 hours. Critical vulnerabilities are patched within 72 hours.
Notification: Affected users and relevant authorities are notified within 72 hours of a confirmed breach, in compliance with GDPR Article 33.
Investigation: All incidents are documented with root cause analysis and remediation steps. Audit logs are preserved for investigation.
Data Processing Agreement
Data Controller: The school (you) is the data controller. Decimal (Omix Digital Solutions) is the data processor.
Purpose: Data is processed solely for the purpose of providing school management services as directed by the school.
Sub-processors: Supabase (database hosting), Vercel (app hosting), Google (authentication). All sub-processors are GDPR compliant.
Data Deletion: Schools can request complete data deletion at any time. Data is permanently removed within 30 days of request.
Data Export: Schools can export all their data in standard formats (CSV, JSON) at any time.
DPA Contact: For a full Data Processing Agreement, contact omixsystems@gmail.com or WhatsApp +254 768 213 649.
Security Contact
If you discover a security vulnerability, please report it responsibly to:
Security reports and general inquiries share one inbox — mention “security” in the subject line. We respond within 48 hours and aim to resolve confirmed vulnerabilities within 72 hours.