How your school’s records are kept.
Before your school moves its records into Tendao, you should know who can see them, how they are kept apart from other schools’, and what happens when the AI is switched on.
Your school’s records stay your school’s.
Each school has its own Tendao address. The database itself keeps every school’s records apart, not just the app, so a request made for one school cannot read another school’s rows.
Each person sees what their role needs.
- Administrators run the school’s setup: grading, report cards, imports, settings and the activity log.
- Bursars work with fees, invoices and payments.
- Teachers work with the groups they teach: registers, homework, marks and schemes of work.
- Pupils see their own work, marks and fees.
- Parents see their own children’s.
Signing in.
Passwords are stored scrambled, never as written. Too many wrong passwords lock the account. A password reset code lasts thirty minutes.
A record of who changed what.
The activity log records sign-ins, payments and reversals, invoices, mark changes, grading changes, published report cards, password resets and imported people. Only the school’s administrators can read it.
Mistakes are corrected, not erased.
A payment is reversed rather than deleted, an invoice is cancelled with a reason, and a report card is corrected beside the published one. The history stays.
When the AI is switched on.
The AI is off until an administrator turns it on. When it is on, the question and the class information needed to answer it are sent to Anthropic, which makes Claude.
The AI can only read what the person asking could already see. Pupils’ tutor conversations can be read by their teacher and the school’s administrators, and pupils are told so.
Questions to ask us.
We’ll answer these in writing for your school: where your records are kept, how they are backed up, how you can take them with you if you leave, and how long they are kept.
