Guide
Security best practices for administrators
What Masira maintains, and the practices your institution should follow.
This guide summarizes the protections Masira maintains and the practices your institution should follow.
What Masira maintains
- Every record is tagged to your institution, enforced by row-level security.
- Billing state is managed server-side and is never exposed to client code.
- Changes to students, families and grades are audit-logged, and records are archived rather than destroyed.
- Traffic is encrypted in transit over HTTPS.
- Payments are processed by Stripe; card numbers never touch Masira.
- Exports are sanitized against spreadsheet formula injection.
What your institution should do
- Give each staff member their own login, and remove access promptly when someone leaves.
- Assign roles that reach only the modules each person needs.
- Record only the personal information you are required to keep, and obtain guardian consent where laws such as FERPA, COPPA or GDPR require it.
- Keep portal section choices under review, especially before results are published.
- Download backups regularly and store them outside the app.
Administrators
Administrators can see and change all of your institution's data and manage its users. Treat the role accordingly, and keep the list small.