Trust Center
Trust starts with transparency
A school hands us children's records, families and money. This page explains plainly what we do to protect them, what we do not claim, and how to ask us about any detail before you decide.
Four commitments
Security
Permissions by role and branch, full isolation between schools, and encrypted traffic everywhere.
Privacy
Consents and data requests aligned with the Saudi Personal Data Protection Law (PDPL).
Financial compliance
E-invoicing for schools in line with ZATCA, the Saudi tax authority.
Accountability
An audit log of every sensitive action: who did what, and when.
Security, in detail
Fine-grained permissions
Every user sees only what is theirs, by role and branch. Granting roles and permissions is itself governed by rules that prevent accidental escalation.
Per-school isolation
No school can reach another school's data, and no user can reach a branch they do not own.
Two-factor authentication
Authenticator app or e-mail code, with recovery codes.
Sign-in protection
Accounts lock after repeated wrong attempts, and sessions are revoked as soon as a user is disabled or deleted.
Encryption in transit
All traffic over HTTPS/TLS, with HSTS and protection against embedding pages in outside frames.
Financial controls
Expenses pass through a separate maker and checker; one person cannot perform both steps.
Privacy and children's data
- We collect only what running the school requires, and we do not sell student or parent data.
- The privacy center inside the platform records consents and supports data-access and deletion requests.
- Any user can request deletion of their account from a dedicated page, with published steps.
E-invoicing (ZATCA)
For schools: electronic invoices with signing, a hash chain and the branch's tax number, issued from the collected payment itself with no re-entry. We tell you the stage of every feature before we promise it.
Hosting and continuity
We share where your data is hosted and the backup plan in writing during the demo, so you can compare it with your authority's requirements.
What we do not claim
- We do not display compliance certificates we have not earned, or readiness figures and customers we cannot prove.
- We review our code and run penetration tests regularly, and fix what we find before making any new promise.
Report a vulnerability or ask about privacy
If you found a vulnerability, or have a security question or a data request, send it to us and a person will answer. Good-faith reports are welcome.
Frequently asked questions
- We share the hosting details and location in writing during the demo, so you can compare them with your education authority's requirements.
- No. Data is used only to run the school's services.
- Yes, through a request in the privacy center or the account deletion page, following the published steps.
- Not yet, and we will not announce a certificate before we hold it. We can walk you through the controls in place today.
See Classti with your school's data
Book a short demo: we show the modules that matter to you, talk through your school's size and branches, and prepare a quote afterwards.