A plain answer to every question a school should ask before trusting a platform with its students' data — the architecture, the security, the AI, and every "what if."
Intellio is a deliberately conventional three-tier system. The web application is built in React and served from a global CDN; the mobile app is React Native — one codebase compiled for Android and iOS. Both clients speak to the same backend: a managed PostgreSQL database (Supabase) running on AWS, which also provides authentication (JWT sessions, bcrypt-hashed passwords), file storage, and realtime updates over WebSockets. Server-side logic that must not run in a browser — report generation, push notifications, AI drafting — runs in isolated edge functions with their own credentials.
There is exactly one source of truth. A mark entered by a teacher on the web is the same database row a parent's phone reads seconds later. There is no syncing between copies, because there are no copies.
It's a deliberately boring architecture — one database as the single source of truth, industry-standard login security in front of it, and thin apps on top. In infrastructure, boring is a compliment: nothing exotic to break, nothing clever to go wrong.
All school data resides in a PostgreSQL database in Amazon Web Services' Dublin region (eu-west-1), managed by Supabase — infrastructure certified to SOC 2 Type II, running on AWS facilities certified to ISO 27001. Data is encrypted at rest (AES-256) and in transit (TLS).
Why not an African region? Distance does not affect safety — a record in Cape Town and a record in Dublin are protected by the same two things: encryption and access rules. What Dublin adds is jurisdiction: the data sits inside the European Union, under GDPR, the strictest data-protection regime in the world — a stronger legal umbrella for children's records than most locally hosted alternatives, which typically lack these certifications entirely. No law in Mozambique currently requires school data to be stored in-country. The performance cost is a fraction of a second per request, imperceptible in use — and should regulation ever require African residency, the architecture supports migration to AWS's Cape Town region (af-south-1).
The data lives in Amazon's Irish data centre — European Union territory, with the world's toughest privacy laws standing over it. Data doesn't become safer by being nearby; it becomes safer by being locked well and governed strictly. If the law here ever demands local hosting, the system can move. Until then, EU protection is the strongest home available for your students' records.
Yes — and the key fact is that Vercel holds no data. Vercel serves only the static frontend: the JavaScript, HTML and CSS that make up the interface. When a user opens the app, the browser downloads the interface from Vercel's CDN, and from that moment every piece of data flows directly between the browser and the database over TLS — it never rests on, or routes through, Vercel's servers. HTTPS is enforced and DDoS mitigation is built into the platform.
Vercel is the company behind Next.js, and its enterprise customers include PayPal, Stripe, Ramp, and OpenAI — companies whose entire business is moving other people's money or handling sensitive workloads. They can use it safely for the same reason we can: in this architecture the frontend host is stateless. That statelessness is itself a security property — were Vercel ever to fail, the identical frontend redeploys to another CDN in an afternoon, and not a single record is touched, because there are no records there to touch.
Vercel is the shop window, not the safe. It shows the app to your browser; the actual records never live there. Companies that move billions — PayPal, Stripe — trust this exact setup, because the window and the safe are kept strictly apart.
Files receive the same treatment as rows: report cards, photos and voice notes live in private storage buckets, inaccessible to the public internet, and are served exclusively through signed URLs that expire after one hour, issued only to authenticated members of the school. We verify this from the outside: anonymous requests to stored files are rejected by the platform.
Three locks. The data is sealed while it travels, sealed while it's stored, and — most importantly — the filing cabinet itself checks the ID of every person for every single folder. Even if someone found a flaw in the app, the cabinet would still refuse to open the wrong drawer.
| Role | Can see |
|---|---|
| Parent | Only their own linked children — records, marks, attendance, report cards, communications. |
| Student | Only themselves. |
| Teacher | Their classes, at their school. |
| Principal / Admin | Their school — and only their school. |
Every table is keyed by school ID, and Row-Level Security enforces tenant isolation: no school on the platform can ever see another school's data. This is the same multi-tenancy model used by serious business software worldwide.
And the honest answer about our side: a small number of named Intellio engineers can access the database — for support and maintenance only, through credentialed channels, under confidentiality obligations that are written into the service agreement as binding clauses. Any vendor who tells you "nobody at our company can access the database" is describing a system no one can maintain. We'd rather tell you the truth and bind it in contract.
Each person gets exactly their own window: parents see their children, students see themselves, teachers see their classes, the principal sees the school. Schools can never see each other. And on our side — yes, our engineers can reach the database to maintain it, the same way a bank's IT staff can reach the vault room. What binds them is the same thing that binds the bank: contract, confidentiality, and accountability.
When an administrator clicks Generate, a server-side function — running in the backend with service credentials, never in a browser — pulls the class's marks, attendance, conduct and approved comments from the database, computes weighted grades and class positions, and assembles a fully formatted page in the school's own template: its logo, colours, and motto. Cambridge and WAEC grading structures are both supported natively.
That formatted page is sent over TLS to a headless Chrome rendering service, which converts it into a pixel-perfect A4 PDF and returns it. The renderer is stateless — it renders, returns, and retains nothing. The finished PDF is stored in a private bucket and served only through expiring signed links, to exactly the people the database authorizes: that student, their parents, their school's staff. The workflow is draft → review → publish — parents see nothing until the principal publishes.
Think of it as a robot print shop. We hand it a finished page, it prints it to PDF, hands it back, and shreds its copy. The PDF then goes into a locked drawer that only opens for the right parent — with a key that expires after an hour. What used to take the staff room days each term happens for an entire class in one click, in the school's own design.
Begin with the most important fact: the AI has no access to the database. None. It cannot query, browse, or "read" anything. The actual data flow, per request:
One design decision matters above all the others: the student wellbeing feature — where students can privately record how they're feeling — never sends journal text to any AI. Only numeric mood scores are ever processed. A child's private words never leave our database. That was a deliberate choice, not an accident.
Roadmap: with a paid contract in place, the AI drafting layer is planned to migrate to Anthropic's Claude — a provider whose API is contractually committed to not training on customer data, selected specifically for its enterprise privacy posture in sensitive contexts.
The AI is like a consultant standing outside the records room. It never gets a key. A staff member copies three numbers onto a card, steps outside, asks "how would you phrase a comment about a student with these results?", takes the draft back inside — and a human teacher decides whether to use it. And a child's private diary never gets read to the consultant at all.
Every night, an automatic copy. If something is deleted by mistake, yesterday's version can be brought back. If the internet drops, the app still shows what it last knew, and nothing already saved is ever lost. And it was built for real phones on real African networks — not for fibre-connected laptops in another country.
Only what a school office already keeps: student names, class enrollment, guardianship links, contact details — and the records the school itself generates through use: marks, attendance, conduct, timetables, fees, and communications. That's the inventory.
Explicitly not collected: no biometrics, no location tracking, no advertising identifiers, no behavioural profiling, no third-party trackers. The platform has no advertising and the data is never sold or shared for marketing — a prohibition written into the service agreement, not just this document.
We hold the same information the school's own filing cabinets and mark books hold — just organized, protected, and useful. Nothing more. The honest answer to "what do you collect?" is deliberately boring.
Onboarding is assisted, not self-service. The Company imports the school's existing registers — students, classes, subjects, staff, parent contacts — and provisions every account: the school does not type its own data twice. Grading structure (Cambridge three-component, WAEC continuous assessment, or the school's own weighting), term dates, conduct criteria and report card templates are configured to match how the school already works — the platform adapts to the school, not the reverse. Staff training is included, and the first term runs with hands-on support.
You hand us your existing lists; we do the moving-in. Teachers get a working system with their real classes already loaded, set up to grade the way your school already grades — and a person to call while they learn it.
The school owns its data; the Company is its custodian. That is a contractual clause, not a slogan. In practice:
Technically this is clean because every record is keyed to the school's ID — one school's data can be exported or erased precisely, without touching anything else. These exit terms apply in full during the trial period.
The data is yours the way money in a bank account is yours — we guard it, we never own it. Leave whenever you choose: you take everything with you in ordinary files any system can read, and then we delete our copy and confirm it in writing. No hostages.
A fair question of any young company, and it deserves a structural answer rather than a reassurance. Three protections, independent of each other:
We answer this one structurally, not with promises: the records live in Amazon's data centre, not in anyone's office; the law says they're yours; and there is a button in your own dashboard that downloads your complete copy — press it whenever you wish, without asking anyone. Even if this company vanished overnight, your school would lose nothing — you'd already be holding it all.
A dedicated support team of developers — reachable by WhatsApp, phone and email during school hours. Critical issues are acknowledged within four business hours, with a fix or workaround targeted inside 24–48 hours; routine requests are answered within two business days. These are contractual commitments, and they are precisely what the subscription funds: real engineers on call, not a help forum.
Beyond support, something no established vendor offers: the school shapes the product. This platform was developed with this school in mind, and the offer is formal — any adjustment, change, or feature the school wants integrated, the Company builds. Report formats, workflows, ministry requirements, ideas from the staff room: the roadmap bends around the school that uses it.
When something breaks, you message actual developers — the same day, not a ticket queue in another timezone. And when you want the system to do something new, you ask, and it gets built. That's the difference between using software and having a development team.
The platform's design — minimal collection, purpose limitation, role-based consent-driven access, encryption, export and deletion rights — follows the principles of the African data-protection frameworks (such as South Africa's POPIA), which are themselves modeled on the EU's GDPR. The data already sits physically under GDPR-grade infrastructure and certifications. Mozambique does not currently impose a data-localization requirement for school records; if future regulation does, the migration path to African hosting exists (Question 2). The service agreement additionally commits the Company to breach notification within 72 hours — the GDPR standard.
The system was built to the strictest privacy standard in the world, so it clears the local bar with room to spare — and if the local bar ever moves, we've already mapped the path.
This is the right question, and it deserves the longest answer in this document. Five parts.
A platform holding children's data costs real money every month — servers, storage, security, maintenance, people. So the first question about any free platform is not "what does it do?" but "who is paying for it, and what are they getting in return?" The honest possibilities: advertising shown to your community; monetization of the data itself; "free until you depend on it" pricing; or a passion project maintained in someone's spare time — until it isn't. For a school, every one of those is a bill that arrives later, in a worse currency.
The genuinely good free tools solve teaching workflow or messaging. They do not run a school. Fee tracking, discipline and merit systems, timetable generation, staff leave and HR, Cambridge- and WAEC-formatted report card generation, attendance analytics, and parent communication with an audit trail — in one system, one login, on web and mobile. The "free alternative" to that is not one product; it is five disconnected apps, a pile of spreadsheets, and paper — paid for in staff hours, every single week, forever. Free tools are free the way a free puppy is free.
Most school platforms don't fail on features. They fail the way schools have already experienced: the vendor vanishes after the sale, support never answers, and there is no recourse — because nothing was ever owed. That failure is precisely what a paid contract exists to prevent. The fee is what makes the Company accountable: a signed agreement covering support response times, data ownership, unlimited free exports, breach notification, and deletion on exit — obligations the school can hold the Company to. A free platform owes the school nothing. It cannot be held to support, cannot be stopped from changing, and cannot even be complained to when it shuts down.
Separate two things. The infrastructure is not unproven — PostgreSQL, AWS, Supabase and Vercel, the same managed providers that run banks, hospitals and governments; nothing in the foundations is experimental. What's new is the product — and being the first school is not the risk position; it is the leverage position. The founding school gets a direct line to the developers and a roadmap that literally bends around its needs — the arrangement in which a vendor cannot drift away from what the school wants, because the school's expectations are the specification. That's not a claim about what happens elsewhere at scale — it's a commitment about what stays true here as Intellio grows.
A school system proves itself in exactly one term — because everything a school does, it does every term: enrollment, attendance, marks, discipline, exams, report cards, parent communication. One full cycle of all of it fits inside three months. If the platform hasn't proven itself after a complete term, months four through twenty-four will not change the verdict. A vendor offering years of free use is revealing something: either your usage costs them nothing because you are the product, or they are burning money and will one day vanish or squeeze. Three months is a real test with a real commitment behind it — and the exit guarantee applies in full during the trial: walk away, and every record is exported to you and everything is deleted, in writing.
Free platforms cost the most — you just pay in a different currency: your community's attention, your data, your staff's hours, and your recourse when things go wrong. What the subscription buys is the one thing no free product can offer: a company that is contractually answerable to your school — for its data, its support, and its future. One term will prove it. And even the trial comes with the keys to leave.