One school cannot see another
Most systems keep tenants apart by remembering to add a school filter to every query. That works until someone forgets once, and the failure is silent: a page renders, and it shows another school's pupils.
Kundi pushes the rule into Postgres instead. Every table that holds school-specific data carries a row-level security policy, forced on, so the database itself refuses to return another school's rows. A query that forgets its filter returns nothing, rather than everything. Cross-school references are blocked by the table structure, so enrolling one school's pupil into another school's class is not a bug we have to catch, it is a row the database will not store.
A conformance check runs on every build and fails it if any table holding school data is missing that policy.
Your data is yours, on every plan
Full export is never gated. Not on the free plan, not while an invoice is outstanding, not after you cancel. It is a portability right under the Nigeria Data Protection Act, it costs us almost nothing, and a school that knows it can leave rarely wants to.
If a plan lapses or a module is removed, your data stays readable and exportable. Writes stop; nothing is deleted. A school that stops paying for the accounting module keeps its ledger, because it is legally obliged to keep it.
Who is responsible for what
| Your school | Data controller. You decide what is collected and why, and you answer to parents and to the regulator for it. |
|---|---|
| Kundi | Data processor. We hold and process it on your instruction, under a data processing agreement, and we do not use it for anything else. |
| Regulator | The Nigeria Data Protection Commission, under the Nigeria Data Protection Act 2023. |
This is children's data, which the Act treats as the most sensitive category there is. We would rather over-explain that than have it come up after something goes wrong.
What we do not do
- We do not sell or share your data, and we do not advertise against it
- We do not use one school's data to build features for another
- We do not train models on pupil records
- We do not require a parent to install an app to read a result
Still being built
Kundi is early, and it would be dishonest to describe a finished compliance programme. These are in progress rather than done, and we will say so on this page until each one is:
- Registration with the NDPC and the annual audit return
- A named Data Protection Officer
- Subject access and erasure tooling in the control plane, not manual queries
- A published retention schedule per data class, with automated purge
- A breach register and a tested 72-hour notification path
- Confirmation of whether data residency in Nigeria is required for your school
Reporting something
If you think you have found a security problem, email hello@kundihq.com with enough detail to reproduce it. We will confirm we have read it. Please do not test against a live school's data, and please give us a chance to fix it before publishing.