Identity before authority
Authentication proves who a person is. It should not by itself grant a teacher, parent, school or administrative role.
SECURITY & DATA GOVERNANCE
Security is about who may do what — not just whether a password exists.
VibeSchool’s trust model separates identity, authority, data purpose and evidence. The goal is to make private educational information useful to the right people without making it broadly accessible.
CORE PRINCIPLES
Role and relationship boundaries
Access to learner and school information should follow verified relationships, assignments and institutional authority.
Least-necessary access
People and systems should receive only the information and capabilities required for the task they are authorised to perform.
Server and database enforcement
Sensitive authority should be enforced beyond the browser. A client-side button, URL or role selector is not an access-control system.
Evidence and auditability
Consequential changes should preserve enough evidence to understand who or what acted, under which authority and what outcome followed.
Fail closed for uncertainty
When identity, authority or required evidence cannot be established, the safer default is to withhold the sensitive action rather than guess.
PUBLIC VS PRIVATE
A useful public website should not expose private educational operations.
Public pages can explain VibeSchool, show public catalogue information and provide safe discovery experiences. Learner records, private school operations, family relationships and authenticated support remain behind appropriate identity and authority boundaries.
When public information is evidence-backed, VibeSchool should preserve provenance so users can distinguish a verified claim from guidance or an incomplete record.
DATA GOVERNANCE
Data should have a purpose, owner and lifecycle.
Good governance requires understanding why information is collected, who can access it, how long it is needed, what source supports it where relevant and how corrections or deletion requests are handled.
VibeSchool’s formal privacy commitments are described in the Privacy Policy. Institutional deployments may require additional agreements and controls appropriate to the participating organisation.
Read the Privacy Policy →Found a security or privacy concern?
Do not post credentials or sensitive learner information publicly. Contact VibeSchool with the minimum information needed to reproduce or understand the concern.