How we keep payments and your family's data safe
Families trust Skoolview with their kids' school life and, when they pay for a seat, with a card. Here is exactly how that is protected, in plain words.
Paying for Skoolview
- Your card never touches Skoolview. When you subscribe, you are taken to a page run by Stripe, a certified payment processor (PCI DSS Level 1, the strictest level) used by millions of businesses. You type your card there, on Stripe's encrypted page. Our servers never see, receive or store a card number, expiry date or security code.
- We keep only a reference. Skoolview stores an identifier for your plan and your Stripe customer record, the plan you chose, its price and its renewal date. That is all.
- Changing your card, cancelling, receipts. All of it happens on Stripe's own secure portal, opened from Billing & coverage. Stripe sends the receipts. Your statement shows the charge as Skoolview.
- Your bank may ask you to confirm. Stripe supports 3-D Secure, so when your bank wants an extra check (a code in your banking app, for example) it happens right there. Stripe also screens every payment for fraud.
- A failed payment never deletes anything. You get a message, your kids stay covered for a grace period, and every grade, assignment and record is kept whatever happens to the subscription.
- Codes cannot be guessed. A school code or promotion code that does not match is remembered; after a handful of wrong codes the account has to wait before trying again, and the attempts are logged.
Signing in
Skoolview never stores your password. Sign-in is handled by Microsoft Entra, the same identity service behind Microsoft 365, with email verification, password reset and two-step verification. Skoolview keeps only a signed session cookie that expires.
Your kids' school logins
When you connect a school tool that needs its own login, those credentials are encrypted the moment they are saved, with a key per connection wrapped by a key held in Azure Key Vault. They are decrypted only inside our sync service to read that kid's data, are never shown again, and are deleted when you disconnect the tool.
In transit and at rest
- Every page and every connection is HTTPS only, and browsers are told to keep it that way (HSTS).
- Skoolview pages cannot be embedded inside other websites, which blocks a class of click-tricking attacks.
- The database runs on Microsoft Azure with encryption at rest; application secrets live in Azure Key Vault and the hosting platform's protected settings, never in code.
- Messages from Stripe to Skoolview are signed; an unsigned or altered message is rejected and a repeated one is ignored.
Who can see what
A kid's data is visible to the family that created the profile, to the kid if a student login was made, and to staff of the school the kid is enrolled at, only for school communication. Every space is separated from every other in the database.
What we never do
- Sell data, or use it for advertising.
- Store card numbers, or ask for them anywhere but on Stripe's page.
- Delete a kid's history because of a payment, a cancellation or a move.
- Email you asking for a password or card details. If you ever get such an email, it is not from us.
We keep records
Every administrative action, every payment event and every change to a plan leaves an entry in an audit log that cannot be edited from the app. That is how we investigate a question and how we would notice misuse.
Tell us
Found something that looks wrong? Email security@skoolview.com. We read every report and we do not take action against anyone who reports in good faith.