Communications
One way out, and the build enforces it.
Each message a school sends leaves through a single path that checks who may be told what. Nothing is allowed to go around it: not a feature, not a background job, not an extension. That is checked when the code is built.
At a glance
Kestrel’s communications module sends each message through one path that checks who may be told what, and records where each message got to.
One path out
Each message leaves through one send path, enforced when the code is built.
Decided per message
Who may be told is worked out for each child and purpose at the moment of sending.
Each suppression recorded
A withheld recipient gets a row naming the rule that withheld them.
Where each message got to
One screen shows what was sent and how far each row travelled.
Questions schools ask
How does Kestrel respect parenting orders when messaging?
The send path asks who may be contacted about this child, for this purpose, at the moment of sending.
Can we see who a message reached?
One screen shows what was sent and, for each row, how many recipients it reached.
What happens to a withheld recipient?
They get a row naming the rule that withheld them, so each suppression is recorded.
Show the detailHide the detail
One way out, enforced by the build.
Kestrel enforces it in the build: anything that reaches a contact point or a delivery provider without going through the send path fails the build. A handler, a scheduled job and a third-party extension are all held to it equally.
The difference matters because of a common failure mode: a well-meant feature that emails parents directly and quietly skips the rest of the system’s checks. Here, that code does not ship.
An extension a school installs is held to the same path as Kestrel’s own code. It cannot reach a family behind the school’s back, because there is no route for it to reach them by.
Who may be told, decided per message.
The send path asks who may be contacted about this child, for this purpose, right now. Protection is evaluated at the moment of sending.
What was sent, and where it got to.
One screen holds what the school has sent and how far each row travelled. The compose page offers the groups, the purpose and the channels, so the purpose a message was sent under is recorded with it. It does not have to be reconstructed later from the message’s wording.
Templates the office sends from are versioned, so a notice can be reissued exactly as it was sent.
Both screens fit a phone without scrolling sideways and pass the accessibility sweep, because the front office reads them standing at a counter.
Bring your most sensitive message.
Start with the eight-minute film. Then, if you’d like, forty minutes with us on your orders and your distribution lists.