A school’s software holds some of the most sensitive data in any organisation: children’s names, dates of birth, Aadhaar numbers, home addresses, parents’ phone numbers, health notes and every fee payment. India’s Digital Personal Data Protection Act, 2023 also puts responsibility on organisations that collect personal data. Yet most schools choose software on features and price, and ask about security last. Use this checklist before you sign, and again once a year.
The 10-point checklist
1. Every login sees only its own screens
The fee clerk should not see payroll, and a class teacher should not see other classes’ fee dues. Ask for role-based rights at menu level, with no “view everything” default for new users.
2. Money actions need a second password
Receipt cancellation, receipt modification and backdated entries are where fee fraud happens. A separate transaction password, different from the login password, stops a borrowed or shared login from moving money.
3. Every change is logged
The system should record who changed what, and when, for every screen. When a figure looks wrong, the log should answer the question in minutes.
4. Nothing is silently deleted
Student records from past sessions should be kept, not overwritten, so that transfer certificates and verification requests years later can still be answered from the system.
5. Data travels encrypted
The web panel and the parent app should only work over HTTPS. Check that the browser shows a padlock on the login page, and that no page falls back to plain HTTP.
6. Staff leave, their access leaves too
When a teacher or clerk leaves, their login must be disabled the same day. Ask how quickly an administrator can do it, and whether there is a list of active users to review each term.
7. Parents see only their own child
Test it yourself: log in to the parent app as one parent and confirm you cannot reach another child’s details, marks or receipts by changing anything in a link.
8. Payments are verified with the gateway
Online fee payments by UPI, cards or netbanking should only produce a receipt after the software has confirmed the payment with the gateway. This prevents fake “payment successful” screenshots and double receipts.
9. You can take your data out
Your school owns its data. You should be able to export students, fees, attendance and marks to Excel at any time, without a support ticket or a fee.
10. Collect only what you need
Good data protection starts with collecting less. Ask your office which fields are really needed at admission, and keep sensitive notes (such as medical details) visible only to the staff who need them.
Questions to ask any vendor
- Can you show role-based rights and the user action log live in the demo?
- How are backups taken, and how quickly can data be restored after a problem?
- Who at your company can access our school’s data, and how is that access controlled?
- What happens to our data if we stop using your software?
For legal obligations under the Digital Personal Data Protection Act, 2023, take advice from your own legal adviser. The checklist above covers the practical controls that school software should give you either way.
How Schoolyam protects school data
Schoolyam gives each role menu-level rights, protects money-related actions with a separate transaction password, and logs every user action with user, date and time. Past sessions’ records are preserved, every online payment is re-verified with the gateway before a receipt is issued, and almost every report exports to Excel. See the users and permissions module, or book a free demo to see these controls on your own school setup. Sales: +91 70805 67519 (also on WhatsApp). Support: +91 95190 62549.
