Every school in its own vault.

Each institution gets a separate database. Passwords are hashed with Argon2id, sign-ins are throttled, every action is logged, and permissions are checked on every page, not just in the menu.

Ask a security question Read the privacy notice

One database per institutionArgon2id passwordsEvery action logged

1Database per institutionNo shared tables. Your records never sit next to another school’s.

100%Pages permission-checkedEvery page and every record, not just the menu.

0Questions stored by LaneOnly a daily count of how many were asked.

Any timeFull exportDownload your data whenever you want. It is yours.

How your data is kept apart.

Every sign-in is bound to exactly one institution, and every institution has a database of its own.

Parents and studentsSee only their own records and children

Teachers and staffSee only their classes and their campus

Principals and ownersSee what their role allows, nothing more

One sign-in page, bound to one institutionRole and campus checked on every page and every record

Beacon Hill SchoolIts own database

Riverside UniversityIts own database

Orion AcademyIts own database

Margalla CollegeIts own database

In detail.

What we do to keep each institution’s records private and safe.

Every institution in its own database Each school, college or university gets a separate database. Website content and billing live in another one again.Every request is bound to exactly one institution. Its session, its signed links and its assistant tokens carry that institution’s identity and are rejected anywhere else.On the Network plan each institution’s database can have its own database account with rights to that database only.

Access that follows the role Permissions are checked for every page and every record, not just hidden from the menu. A parent can only open their own children; a teacher only their classes; campus staff only their campus.Administrators cannot grant a role more than they hold themselves, and only a super admin can change another super admin.Exports, sign-ins, permission changes and deletions are written to a security log.

Sign-in protection Passwords are hashed with Argon2id and must meet a strength policy.Sign-in attempts are limited per account and per network, accounts lock temporarily after repeated failures, and response times do not reveal whether an account exists.Sessions use secure, HTTP-only cookies that expire after inactivity and after a fixed number of hours, and get a fresh identifier at every sign-in.

Web application defences All database access goes through prepared statements; every value shown on a page is escaped.A strict Content Security Policy, anti-framing and anti-sniffing headers, and per-form tokens protect against cross-site attacks.Errors are logged privately with a reference number; visitors only ever see a short message and that reference.

Attendance devices Fingerprint and face templates stay on the terminals. InstLane receives only an enrolment number or card number, and stores card numbers as keyed hashes.Each device is registered to one institution, authenticated with its own key or network allow-list, and rate-limited.Replayed or duplicate punches are ignored; punches from the wrong place or at odd hours are flagged for review.

The Lane assistant Lane answers from the same permission-checked queries as the screens. The language model never reads the database and only rephrases the facts it is given.Questions and answers are not stored. Only the number of questions per day is counted.The model can run on your own server, so no student data has to leave it.

Your data, your rules.

Plain commitments about the records you trust us with.

Export everything

Learners, staff, results and fees as spreadsheets, whenever you want.

Deletion on request

When you leave, we give you an export and delete your database within 30 days of your request.

Access by us is logged

We open your workspace only for support you ask for, and each access is recorded.

Never sold, never trained on

We do not sell your data or use it to train AI models.

Secrets kept encrypted

Database passwords and keys for your devices and services are stored encrypted, never as plain text.

We tell you

If something goes wrong that affects your data, we tell you what happened and what we did.

Security questions.

Found a vulnerability? Email hello@instlane.com and we will respond within two working days.

Where is our data stored?

In a dedicated database for your institution. Passwords are hashed with Argon2id and secrets are encrypted at rest.

Who at InstLane can see our data?

Only engineers handling a support request you raised, and every access is logged.

Can we restrict staff to one campus?

Yes. Any staff account can be limited to a single campus, and teachers only see the classes they teach.

Every school in its own vault.

How your data is kept apart.

In detail.

Your data, your rules.

Security questions.

Stop running your institution on registers and group chats.