Security and privacy
Your school trusts CampusMosaic with important information about students and families. CampusMosaic is built to keep that information private, to put it in front of only the people who need it, and to help protect your records from being lost.
Your school's information stays private
Every record belongs to one school. People can only reach a school they have been added to, and someone at another school cannot view your students, families or fees. That check runs on every single page, not just the ones you would think to test.
People see only what their role allows
Administrators run their own school. Teachers reach the students in the classes they teach, and not the school's fee records. Parents see their own children — attendance, progress, grades and balance — and nobody else's. Roles are held per school, so the same person can be an admin at one and a parent at another without the two mixing.
Passwords and signing in
Passwords are never stored in a readable form, so we cannot see yours and neither can anyone helping you. New passwords are turned away if they are too common, too short or too close to your own name or email. Forgotten passwords are reset by emailed link, and repeated failed sign-ins are slowed down automatically.
Protected connections
CampusMosaic uses encrypted HTTPS connections in production, so information is protected while it travels between your browser and CampusMosaic. Browsers are told to refuse an unencrypted connection to us, which matters most on the shared wifi a weekend school actually runs on.
Payments
When a school collects fees online, card details go from the parent's browser straight to Stripe and never reach CampusMosaic. There is no field anywhere in the product for a card number or security code — we keep only the card brand and last four digits so a parent can tell their cards apart. Money settles into your school's own Stripe account.
Backups and recovery
CampusMosaic includes backup and recovery safeguards designed to help protect school records from accidental loss or system failure. Records are backed up on a daily schedule, each backup is verified after it is written, and copies are kept on a rolling basis rather than being overwritten.
Children's information comes first
CampusMosaic was built around schools, families, students and staff, so privacy and access rules are part of its structure rather than something added afterwards. We do not sell, rent or mine student or parent information, there is no advertising in the product, and nothing moves between schools. The records are your school's; we hold them on your behalf and export them to you on request.
Your school stays in control
You decide who gets an account: teachers and parents join by invitation, which is single-use and can be withdrawn, never a password passed around. Importing your existing spreadsheet emails nobody: you see exactly what will be created before anything is saved, and invitations go out when you are ready. Sensitive changes are recorded, and your administrators can read and export that record themselves.
Found a security problem?
Tell us before you tell anyone else and we will work with you. We will never threaten someone who reports a problem in good faith. Write to [email protected].
CampusMosaic has not completed a third-party security certification such as SOC 2 or ISO 27001, and this page is not legal advice. If your board needs specific answers for a review, ask us and we will answer them directly. Last reviewed September 2026.