We know schools have a duty of care around student information. Here's exactly how we protect it — in plain language, not legal jargon.
All data hosted on Microsoft Azure, Australian data centres. Never leaves Australian soil.
All data encrypted at rest using AES-256. All data in transit protected by TLS 1.2+.
We do not sell, share, or monetise student data in any way. No ads. No data brokers. Ever.
Automated daily backups with 30-day retention, and recovery procedures in place.
Your school owns its data. AchievoEDU acts as data processor only. You can export or delete at any time.
AchievoEDU runs on Microsoft Azure data centres located in Australia. Your student data — including backups — stays within Australia and is never processed offshore.
Data sovereignty matters for schools, so we keep it simple: any redundancy or failover stays within Australian regions, and your data does not leave the country.
All database records, files, and backups are encrypted using AES-256 — the same standard used by banks and government departments. Encryption keys are managed securely and rotated regularly.
Every connection between your browser, mobile app, and our servers is encrypted using TLS 1.2 or higher. Older, insecure protocol versions are disabled. HTTP connections are automatically redirected to HTTPS.
Passwords are securely hashed and never stored in plain text. Sessions are authenticated, and role-based access control ensures students, teachers, parents, and admins only see what they're permitted to.
AchievoEDU is developed following OWASP Top 10 practices — guarding against risks like injection, broken access control, and insecure data exposure — with automated dependency and vulnerability scanning. Findings are remediated before deployment.
Automated daily backups with a 30-day retention window. Backups are encrypted, geographically separated within Australia. Point-in-time recovery is available for all databases.
All significant system events — logins, data exports, admin actions — are written to an immutable audit log. School administrators can request access logs at any time.
Australian schools handle student information under the Privacy Act 1988 and the Australian Privacy Principles. AchievoEDU is built to support those obligations — your school stays the data controller, and we act only as your data processor.
Data minimisation — we only collect the information needed to run the platform for your school.
Purpose limitation — student data is used only to operate AchievoEDU for your school, never for secondary purposes.
Never sold or shared — no advertising, no data brokers, no monetisation of student data.
Access & correction — schools and individuals can request access to, or correction of, their data at any time.
Onshore only — student data stays in Australia.
Export all your school's data at any time directly from the admin dashboard — students, points history, badges, reports. A full assisted export is also available on request.
Request deletion of all school data — including backups — upon subscription termination. Completed within 30 days with written confirmation.
Contact our privacy team directly at privacy@achievoedu.com.au — we respond within 2 business days.
AchievoEDU doesn't ask for sensitive information it doesn't need to operate.
All student-generated content (shout-outs, student voice, gratitude wall) passes through a profanity filter before appearing on screen.
A dedicated reporting tool lets students report bullying or safety concerns directly to pastoral staff — with emergency escalation for high-risk disclosures.
Daily wellbeing check-ins give pastoral teams early visibility of students who may be struggling — enabling timely intervention before issues escalate.
We're happy to provide a Data Processing Agreement (DPA), answer questions from your IT department, or provide documentation for your school's procurement process.
Contact privacy@achievoedu.com.au