Protecting school information

Connections to the RefocusED platform are protected using HTTPS and Transport Layer Security.

TLS encrypts information while it moves between a user's browser and the platform, helping protect it against interception, alteration and unauthorised access during transmission. Administrative and technical access to supporting cloud services also uses encrypted connections.

The managed RefocusED PostgreSQL database is encrypted at rest using AWS-managed encryption controls.

AWS RDS encryption uses the Advanced Encryption Standard with 256-bit keys. Encryption applies to the underlying database storage, database logs, automated backups and snapshots. Other operational storage and backups are also protected using managed encryption controls.

RefocusED uses role-based access control to determine which functions and information are available to each authorised user.

Access is assigned according to the user's organisation, responsibilities and approved role. This helps ensure users can access only the functions and records relevant to their work.

Administrative, technical and support permissions follow the principle of least privilege.

Accounts receive only the level of access required for an authorised task. Privileged access is restricted, reviewed and capable of being removed when it is no longer required.

Protected services are accessed through individual named accounts rather than shared administrative credentials.

Multi-factor authentication is enabled across RefocusED's key administrative and business services, adding an additional security check beyond the account password.

RefocusED is a multi-school platform designed to separate each organisation's records.

School-scoped permissions operate alongside role-based controls so authorised users are associated with the correct organisation and permitted records. Records are logically separated by school.

RefocusED records important account, security and platform activity to support accountability, troubleshooting and investigation.

This can include authentication events, account and role changes, record updates, exports, downloads, deletion activity and relevant application or security events.

RefocusED uses encrypted database backups, automated snapshots and point-in-time recovery controls.

Recovery arrangements are maintained and reviewed to support service restoration following operational failure, data corruption or a security incident.

The platform and its supporting components are maintained through software updates, dependency monitoring, security alerts, developer review and vulnerability-management processes.

Higher-risk issues are prioritised for faster investigation and remediation. Where an immediate permanent correction is not possible, temporary configuration or access controls may be applied to reduce exposure.

Technical and support access is limited to authorised personnel who need it to maintain, secure or troubleshoot the platform.

Access is protected using named accounts, multi-factor authentication, encrypted connections, restricted permissions and confidentiality requirements.