We know schools have a duty of care around student information. Here's exactly how we protect it — in plain language, not legal jargon.
Your records, database and backups are stored in Microsoft Azure's Australian data centres.
All data encrypted at rest using AES-256. All data in transit protected by TLS 1.2+.
We never sell or monetise student data, and never share it for advertising. No ads. No data brokers. Ever.
Automated daily backups with 30-day retention, and recovery procedures in place.
Your school owns its data. AchievoEDU acts as data processor only. You can export or delete at any time.
AchievoEDU runs on Microsoft Azure data centres located in Australia. Your student records, database and backups are stored and stay within Australia. Two delivery services are the exception: push notifications (via Google Firebase and Apple) and transactional email (via Resend) may process a device identifier, email address and minimal message content overseas.
Your stored records and backups, including any redundancy or failover, stay within Australian regions and do not leave the country. The only cross-border flow is the notification and email delivery noted above, and we use those providers solely to deliver our own alerts and emails on your behalf — never for their own purposes. Our full sub-processor list is in our Privacy Policy.
All database records, files, and backups are encrypted using AES-256 — the same standard used by banks and government departments. Encryption keys are managed securely and rotated regularly.
Every connection between your browser, mobile app, and our servers is encrypted using TLS 1.2 or higher. Older, insecure protocol versions are disabled. HTTP connections are automatically redirected to HTTPS.
Passwords are securely hashed and never stored in plain text. Sessions are authenticated, and role-based access control ensures students, teachers, parents, and admins only see what they're permitted to.
AchievoEDU is developed following OWASP Top 10 practices — guarding against risks like injection, broken access control, and insecure data exposure — with automated dependency and vulnerability scanning. Findings are remediated before deployment.
Automated daily backups with a 30-day retention window. Backups are encrypted, geographically separated within Australia. Point-in-time recovery is available for all databases.
All significant system events — logins, data exports, admin actions — are written to an immutable audit log. School administrators can request access logs at any time.
Australian schools handle student information under the Privacy Act 1988 and the Australian Privacy Principles. AchievoEDU is built to support those obligations — your school stays the data controller, and we act only as your data processor.
Data minimisation — we only collect the information needed to run the platform for your school.
Purpose limitation — student data is used only to operate AchievoEDU for your school, never for secondary purposes.
Never sold for profit — no advertising, no data brokers, no monetisation of student data.
Access & correction — schools and individuals can request access to, or correction of, their data at any time.
Onshore storage — student records, database and backups stay in Australia; only push and email delivery (Google, Apple, Resend) is processed overseas.
Export all your school's data at any time directly from the admin dashboard — students, points history, badges, reports. A full assisted export is also available on request.
Request deletion of all school data — including backups — upon subscription termination. Completed within 30 days with written confirmation.
Contact our privacy team directly at privacy@achievoedu.com.au — we respond within 2 business days.
AchievoEDU doesn't ask for sensitive information it doesn't need to operate.
All student-generated content (shout-outs, student voice, gratitude wall) passes through a profanity filter before appearing on screen.
A dedicated reporting tool lets students report bullying or safety concerns directly to pastoral staff — with emergency escalation for high-risk disclosures.
Daily wellbeing check-ins give pastoral teams early visibility of students who may be struggling — enabling timely intervention before issues escalate.
We're happy to provide a Data Processing Agreement (DPA), answer questions from your IT department, or provide documentation for your school's procurement process.
Contact privacy@achievoedu.com.au