Kestrel
Watch the walkthrough

Architecture and security

Everything on this page is checkable.

Identity, access, audit, hosting and resilience, set out so your IT team can check each one.

The short version

Phishing-resistant sign-in for each role, included. Passkeys and SSO against Entra ID and Google Workspace, at no extra cost.

Wellbeing, medical, counselling and child-safety records are separately governed. A classroom teacher never sees a counselling note through a general wellbeing permission.

Audit records reads as well as writes. Each access to a sensitive record is recorded, including our own support access.

Australian hosting and onshore support. Records are stored and processed in Melbourne, Victoria.

Each point is set out in full below.

Completing a security questionnaire?

How it is built, in a minute.

Sign-in, each school kept apart, access by role, the audit trail, tokens for other systems, and where the records and backups live. Real screens, invented data.

How Kestrel is built. 1:03 · captions on screen
01

Identity

Phishing-resistant sign-in is included at no extra cost, because schools are targeted and passwords get reused.

PasskeysWebAuthn, platform and roaming authenticators, for the school’s people and parents, at no additional cost.
Single sign-onSAML 2.0 and OpenID Connect against Microsoft Entra ID and Google Workspace. Your directory’s groups decide each person’s standing at each sign-in, so leavers lose access the moment your directory records their departure.
Multi-factorA school can require a passkey for its people, and a passkey counts as two factors.
SessionsPer-device sessions, revocable individually by an administrator. Configurable idle and absolute lifetimes, set separately for staff and student roles.
Local accountsFor the people outside your directory: casual relief teachers, external coaches and parents, signing in with a passkey or an emailed code.
02

Authorisation is per record class.

Kestrel governs each kind of sensitive record on its own. A counselling note, a behaviour entry and a reportable-conduct record each reach only the people who need them. The data layer enforces the separation.

Record classDefault reachNotes
Pastoral entries Teachers of the student, tutor, head of house Positive and negative observations, awards, detentions.
Wellbeing Head of house, wellbeing team Visible as an alert to classroom teachers without exposing the entry text.
Medical Nurse, front office; alerts to the people who supervise Conditions and action plans surface on rolls and excursion lists. Treatment detail stays out of them.
Counselling Named counsellors only Health information. Excluded from general wellbeing reads and from exports by default.
Child safety Named officers only Separate store, separate audit stream, retention floor of 45 years, legal hold available.
Family and financial Registrar, business office Parenting orders and per-guardian permissions govern what each parent receives.

Kestrel enforces a court order. Where a parenting order restricts contact, collection or correspondence, the restriction is a property of the relationship record. Reports, messages and portal access route accordingly.

If your permission model is more complicated than this, with boarding houses, multiple campuses or a counsellor shared with another school, describe it and we will show you how it maps.

Bring it to a walkthrough
03

Audit of each read and write.

What is recordedReads as well as writes on all sensitive record classes. Actor, subject, action, timestamp, source address and session. Reads are recorded because who looked matters as much as who changed.
IntegrityAppend-only. No one at Kestrel can alter your audit history, and our own access to your tenant is written into the same stream you can read.
RetentionSeven years, and the clock runs from the access, whatever the age of the record it touched. A privacy incident is often found years after the access that caused it, and the trail is the only evidence of what happened. Seven years matches the attendance register, the longest ordinary obligation your school already has. Exportable for your own archive.
04

Hosting and residency

RegionMelbourne, Victoria. Student data is stored and processed in Australia, on a virtual machine in that region.
SupportOnshore.
TenancyLogically separated per school, with tenant identity enforced at the query layer.
EncryptionTLS 1.3 to the database, verified in full against a pinned authority, and the database publishes no port. Each school’s data is held under its own key, and backups are encrypted on the host before they leave it.
SubprocessorsEach provider is named, with what it does, what reaches it and the country it is in. The records themselves are held by one Australian host; the rest hold no student data.
05

Resilience

Recovery pointEight hours. Encrypted backups are taken three times a day, and the encryption happens on the host before a backup leaves it.
Restore testingA restore is only real once it has been performed. Monthly: on the first of each month the newest backup is decrypted, restored into a scratch database, read back and timed. A backup job that has been failing silently looks exactly like one that works, which is the only reason to test on a clock.
06

An API for your own systems.

Your school issues its own API tokens, each scoped to what it may read and each with an expiry.

What it coversPeople, who is here and who pays, with endpoints for alumni, class rosters, staff import and exports.
RosteringClass rosters for Wonde, OneRoster and School Data Sync: students, teachers, classes and memberships, with no email or phone number.
07

Reporting a vulnerability

If you have found something, we want to hear about it. Report to security@hoverpoint.io. We will keep you updated while we fix it and credit you publicly unless you would rather we did not. Good-faith research is welcome.

—

Completing a security questionnaire?

Tender matrices want a document. The security pack contains our completed questionnaire responses and our subprocessor list.

Request it at security@hoverpoint.io. We will send it whether or not you are in a live procurement with us.

—

Questions schools ask

Are passkeys and single sign-on an extra cost?

No extra cost. Passkeys and single sign-on against Microsoft Entra ID and Google Workspace are included for every role, and a school can require a passkey for its people, which counts as two factors.

Where is student data stored?

In Australia. Records are stored and processed in Melbourne, Victoria, and support is onshore.

Who can read a counselling note?

Named counsellors only. Counselling notes are kept out of general wellbeing reads and out of exports by default, so a classroom teacher never sees one through a general wellbeing permission.

Does the audit trail record who looked at a record?

Yes. Kestrel records reads as well as writes on every sensitive record class, including our own support access, in an append-only trail kept for seven years.

Bring your IT manager.

Start with the eight-minute film. Then, if you’d like, forty minutes with us, and all the questions they bring.

Watch the walkthrough