Tenant isolation
Every school-owned row carries a campus. Postgres Row-Level Security is enabled and forced. The migrate role does not bypass FORCE RLS on Test and production.
Security
Each campus is its own world
GradeHouse is multi-tenant. A query that forgets the campus does not leak another school's students. This page is product behavior — not a legal review. Read the privacy policy for FERPA-shaped copy.
Roles, not a shared login
Office, teacher, and family hats are memberships. A parent never resolves to campus staff. Each person signs in with their own account; write permissions are enforced on every mutation.
Sensitive reads are logged
Health, behavior, support, and student person records record why they were opened. Access logs survive the actor leaving. We do not dump credentials, tokens, or claim URLs into mail logs.
Auth we actually use
Sign-in is Clerk (email, Google, Apple, Microsoft). Schools already require MFA at their identity provider — we do not add a second TOTP wall. A compromised login is revoked at the session, not with a home-grown session store.