Most online academies think about security the way most people think about a smoke alarm: something to deal with after the fire. The trouble is that a school holds exactly the kind of data attackers and regulators care about — children's names, parents' phone numbers, payment history — and the day you're forced to think about it is the worst possible day to start. Here are the basics, in plain terms. You hold more sensitive data than you think An academy's database is quietly one of the more sensitive things on the internet. It links a child's name to a schedule, a location by inference, a parent's phone number, and a record of who paid what. None of it feels dramatic on a Tuesday. All of it is valuable to the wrong person, and all of it becomes your responsibility the moment a student enrols. The first step is simply to take that seriously before anything goes wrong. The day you're forced to care about security is the worst possible day to start caring about it. Encrypt the details that identify a person Phone numbers and parents' names are the crown jewels of a small academy, and they are the most casually handled. Too often they sit in plain text in a shared spreadsheet that six people can open. Contact details should be encrypted at rest, so that even someone who reaches the storage underneath sees ciphertext, not a ready-made contact list. On Clasify they are. Keep each academy's data in its own box If you run on a shared platform, ask a blunt question: can another academy on the same system ever see my students? The answer must be no, structurally — not as a matter of good behaviour. Multi-tenant isolation means each academy's data is walled off from every other, so your records are yours, invisible to the school running on the same infrastructure next door. It is the difference between separate rooms and a shared desk. Lock the front door with two-factor Admin accounts are the master key to everything above. A password alone is a single point of failure, and passwords leak in bulk from unrelated sites every week. Two-factor authentication on admin logins means a stolen password is not enough on its own — an attacker also needs the second factor, which they don't have. Turn it on for every admin before you ever need the story of why you didn't. Make deleting reversible Someone will delete the wrong student, and it will be the week before an audit or a parent's angry call. Permanent deletion turns a slip into a disaster. A soft delete — a trash bin you can restore from — turns the same slip into a shrug. It is a small feature that quietly saves an evening, and occasionally a reputation. A short list to check tonight Are contact details encrypted at rest, or sitting in a plain spreadsheet? Is each academy's data genuinely isolated from every other tenant? Is two-factor authentication switched on for every admin account? Can a wrongly deleted record be restored, or is delete final? Do you know who has admin access, and should they all still have it? Security done well is invisible. Nobody thanks you for the breach that didn't happen. But the academies that treat data as a responsibility from the first day are the ones that never have to write the apology email — and in a business built on the trust of families, that is the email you can least afford to send.