Security and data handling
What we can state about how the software protects institutional data. Where a point depends on your deployment or your agreement, we say so instead of giving a general assurance.
Hosting and deployment
There are two models. In the hosted model, the applications run on Amazon Web Services and serve more than one institution, with each institution's records kept separate from every other's. In the standalone model, the software is deployed for a single institution. Which applies to you, and where your data is held, is stated in your agreement.
Separation between institutions
In the hosted applications every record belongs to one institution, and queries are restricted to the institution of the signed-in user. In the finance application this is enforced a second time in the database itself, and writes are checked against the user's institution.
Access management
Users sign in with individual accounts. Access is granted by role, and in the student information system by page as well. Two-factor authentication with an authenticator app is available there and in Eudemonic AI, which also supports single sign-on through the institution's own identity provider.
Audit trail
Changes are recorded with the user and the time. In the finance application a posted entry cannot be edited or deleted; a correction is made by a reversing entry, and the audit record is append-only.
Data handling
We act on the institution's instructions in respect of its student, staff and financial data. A non-disclosure agreement is signed before institutional data is shared with us. How this website handles enquiry data is set out in the privacy policy.
Sensitive records
Student grievances marked sensitive are held in a restricted queue. In Eudemonic AI, wellbeing analysis is anonymised and aggregated, and a mentor is never shown a score or a diagnosis. See Eudemonic AI.
Backups and recovery
Backup frequency, retention and recovery arrangements depend on the deployment model and are specified in your agreement. Ask us for the arrangements that would apply to you.
Certifications
We do not publish certification claims on this site. If your procurement requires particular certificates or attestations, ask us for the current documentation.
Who is responsible for what
A general outline. The precise division for your institution is the one in your agreement.
| Area | A & S | The institution |
|---|---|---|
| Application | The software, its access controls and its audit records. | Deciding who is given which role, and removing access when staff leave. |
| Accounts | Sign-in, password rules and two-factor authentication. | Requiring staff to use them, and protecting their own credentials. |
| Data | Processing data on the institution's instructions. | The lawfulness of collecting it, and responding to requests from students and staff. |
| Infrastructure | In the hosted model, the hosting environment. | In a standalone deployment, the servers and network it runs on. |
| Integrations | The connection from our side. | Its own accounts with payment, messaging and identity providers. |
Security enquiries
For a security questionnaire, a question about a deployment, or to report a suspected vulnerability, write to director@assoftwaregroup.com. Please report vulnerabilities to us in confidence, and do not access or change data belonging to anyone else while investigating.
What this page is
A statement of what the software does. It is not a certification, an audit report or a guarantee, and it does not replace the security terms of your agreement.
About security and deployment
Is it hosted, or installed on our own servers?
Both models exist. Institutions can use a hosted service in which each institution's data is kept separate from every other institution's, or a standalone deployment for a single institution. The right model depends on your procurement route and your data policy, and is agreed in the proposal.
Can several institutions in a group run on one platform?
Yes. The hosted applications are built to serve multiple institutions, each with its own configuration, users and data.
Who can see our data?
Access is controlled by role, and in the student information system by page as well, with two-factor authentication available. What our own staff can access, and when, is governed by your agreement. See security and data handling.