How Solis looks after your school's information

1. Where your data lives

• The Solis application, and files your school uploads such as its logo and curriculum documents, are hosted by Render in its Frankfurt (Germany) region.
• Your school's records are held in a database run by Supabase in its Zurich (Switzerland) region.
• All connections to Solis are encrypted (HTTPS).

2. Signing in

• Passwords must be at least 12 characters.
• Administrators can turn on two-step sign-in with an authenticator app, so a stolen password alone isn't enough.
• Administrator sessions sign out automatically after 30 minutes without activity.
• Repeated sign-in and password-reset attempts are rate-limited.

3. Who can see what

Everyone at your school signs in with their own account, and each role sees only what it needs:

Owners and administrators

Everything for your school, including finances and settings.

Teachers

The timetable, pupils and registers they need to teach, without the school's invoices, reports or settings.

Reception

Day-to-day information for the front desk, also without invoices, reports or settings.

Parents

Only their own children: timetable, invoices and what you choose to share.

Every page and action checks who is signed in and what their role allows, on the server, not just in what the screen shows.

4. Keeping schools apart

Many schools use Solis, so separation matters. Each school's records are kept apart in the database itself, using row-level security that applies to every query. The application connects with a restricted database role that can only ever see the school it is working for. One school's pupils, families or invoices can't appear in another school's Solis, even through a mistake in a screen.

5. Payments

• Card payments are taken on Stripe's own secure payment page. Card details never pass through Solis.
• The money goes to your school's own Stripe account. Solis never holds or passes on your customers' money.
• Each successful invoice payment is recorded against its invoice in Solis before it is copied to your accounting software.

6. AI features

• AI features are optional and switched on school by school.
• When a feature runs, only the information needed for that task is sent to the AI provider (currently Anthropic).
• A report-card draft uses what the teacher has written about that pupil for the report, including any lesson notes they've marked for report cards, with the pupil's first name and age. It never uses their surname, date of birth, medical information or parents' contact details.
• Ask Solis AI answers from your school's records, but can't see notes written about pupils, medical information or parents' contact details.
• Your school's records are not used to train AI models.
• Drafts are always reviewed by a person before anything reaches a family.

7. Your data, your school

• Your school decides what goes into Solis and is the data controller; Solis processes it on your behalf to provide the service.
• You can export your pupils, classes, staff, enrolments, timetable and reports to Excel whenever you like.
• We'll put a data processing agreement in place with your school before any of your pupils' information is added.
• If you ever leave, tell us and we'll talk through exporting what you need and removing your school's records.

8. Service providers

Solis uses a small number of providers. Each receives only what its job needs, and some are only involved if your school switches that feature on.

The full list, and what each receives, is in our privacy policy.

9. Questions

Email hello@solisapp.co.uk with any security or data question, or to report a concern. See also our privacy policy and terms of use.