Security at SukuuHub

Our approach

Schools keep sensitive information in SukuuHub, including records about children and families’ fee balances. We design the platform so that people see only what they need, data is protected in transit and at rest, and problems are found early.

Access control

• Role-based access means a teacher, bursar, administrator or parent sees only the parts of the system that fit their role.
• Passwords are stored hashed, never in plain text.
• Each school’s data is kept separate from other schools’ data.
• Multi-branch proprietors get a consolidated view only for branches they own.

Protecting data

• Data travels between your device and our servers over encrypted (HTTPS) connections.
• Data stored in our cloud database is hosted with established infrastructure providers and protected by their security controls.
• Regular backups help us recover from failures.

Security when working offline

Offline mode keeps a copy of the data you can access on your own device so you can keep working without internet. That copy is only as safe as the device. To reduce risk:

• lock your phone, tablet or computer with a PIN, password or biometrics;
• avoid using shared or public computers, and sign out when you finish;
• keep your browser and operating system updated;
• remove a lost or stolen device’s access by contacting your school administrator or us.

What schools can do

Security is shared. Schools help protect their data when they:

• give staff accounts only to people who need them, and remove accounts when someone leaves;
• assign the lowest role that lets each person do their job;
• use strong, unique passwords and never share logins;
• tell us straight away about lost devices or suspicious activity.

If something goes wrong

If we confirm an incident that affects personal data, we will investigate, contain it, and notify affected schools without undue delay with what happened and what to do. Where Ghana’s Data Protection Act, 2012 (Act 843) requires it, we will also notify the Data Protection Commission.

Report a vulnerability

If you believe you have found a security issue in SukuuHub, please tell us privately before sharing it publicly. Email hello@emmaktech.com with the subject "Security report" and include:

• what you found and where,
• steps to reproduce it,
• any impact you have identified.

We will acknowledge your report, keep you updated, and fix confirmed issues as quickly as we can. Please act in good faith: do not access or change other people’s data, do not disrupt the service, and give us reasonable time to respond before disclosing details.

Updates

We review and improve our security practices as SukuuHub grows. We will update this page when meaningful changes are made.