Review SENBOX’s security register, access model and data-handling requirements as part of your school’s evaluation. Confirm implemented controls and outstanding verification items for your deployment before onboarding.

A register of technical controls
The Security Register tracks encrypted backups, HTTPS in transit, encryption at rest, development and production separation, monitoring and logging, patching, and role-based access control. Schools can request the current evidence and verification status.

Student data stays within its educational purpose
SENBOX’s stated privacy requirements exclude student data from advertising, unrelated analytics, and AI training. District control over record use, maintenance and redisclosure restrictions must be reflected in the agreed data-handling arrangements.

Encryption with settings verified
HTTPS is the stated standard for connections. Storage, bucket-level and database encryption settings require verification for the deployed environment; a cloud provider’s default encryption does not establish that every component has been checked.

Permissions matched to responsibilities
The access model distinguishes Super Admin, Organisation Admin, Staff and Parent roles, including staff access from organisation and personal devices. Server-side enforcement is required to prevent unauthorised access.

Controlled access for Vietnam-based personnel
The stated requirements include de-identified or synthetic development data, named accounts, multi-factor authentication and logged activity for production access. Schools should confirm permitted overseas access and applicable restrictions in their agreement.

Audit trails for significant actions
Logging requirements cover logins, failed attempts, edits, exports, deletions and support access, without unnecessarily copying sensitive document contents into logs.

Backup and recovery arrangements
The supplied technical information describes seven days of database backups on an AWS EC2 virtual machine and an estimated database restoration time of 15–30 minutes. This is a database restoration estimate; recovery testing, backup protection and service recovery commitments need confirmation.

Incident and breach procedures
Staff are required to follow defined reporting, triage, containment and notification procedures for incidents such as unauthorised access or lost devices. Schools can request the response procedure and agreed notification arrangements.

Subprocessor review
External providers, including AWS services and Firebase authentication where used, must be inventoried and reviewed for data access, retention and contractual protections. Request the current subprocessor list during procurement.