Security
Understand how your institution's information is managed.
Before choosing software, your institution needs clear answers about access, data handling and account protection. This page explains the security controls in Soma360 today.
User roles and permissions
Every staff member has a role that decides which pages they can open and which actions they can take. Permissions are checked on every page and every action, not just hidden from menus.
- Ready-made roles such as institution administrator, principal, registrar, admissions officer, finance officer, lecturer, examination officer, HR officer, librarian and assessor
- Roles you can adjust or create per institution
- Campus administrators limited to their own campus
- Staff accounts created by invitation only, and suspended when someone leaves
Separation of institutional records
Many institutions use Soma360, and each one's records are kept apart. Every record belongs to one institution, and database queries are limited to the institution you are signed in to.
- Institution scoping applied automatically to records
- Automated tests that check one institution cannot read another's records
- Uploaded documents served only after a permission check
- Students see only their own records in the portal
Authentication controls
Sign-in is protected by more than a password for the people with the most access.
- Passwords stored as one-way hashes
- Two-factor authentication with an authenticator app, required for owners, principals, finance and other privileged roles
- Single sign-on with Microsoft, Google or OpenID Connect on the Enterprise plan
- Repeated failed sign-ins are slowed down and recorded
- Users can see their active sessions and sign out other devices
- Temporary passwords must be changed at first sign-in
Protecting data in transit and sensitive fields
Connections are encrypted, and the most sensitive values are encrypted again in the database.
- HTTPS for every page, with HTTP Strict Transport Security
- Secure, HTTP-only session cookies
- Payslip figures stored encrypted
- M-PESA, SMS, WhatsApp and card payment credentials stored encrypted
- API keys stored only as hashes, with scopes limiting what each can do
- Outgoing webhooks signed so receivers can verify them
Audit log
Important actions are recorded with who did them and when, so you can answer questions later.
- Payments recorded, reversed and allocated
- Changes to student records, results and settings
- Report exports and data exports
- Failed sign-in attempts
Data export and deletion
Your institution's data belongs to you.
- Full export of your institution's data as CSV files at any time, by authorised administrators
- CSV export of individual reports and lists
- API access for your own systems
- To close your account and have your data deleted, contact the Soma360 team
Reporting a security concern
If you believe your account or your institution's data has been accessed without permission, or you have found a security problem, contact the Soma360 team straight away on WhatsApp or by phone at 0796 429 489. Institution users can also raise an urgent support ticket from inside Soma360.
No system can be guaranteed perfectly secure. These are the controls in place today, and we will answer specific questions about your requirements.
Discuss Your Security Requirements