Security - PSM

A school trusts PSM with its learners' records, its staff details and its money. This page sets out how we protect them, plainly and without overstatement.

Hosting and data

Encrypted connections

Everything between your browser or the PSM apps and our servers travels over TLS 1.3, so it cannot be read or altered on the way.

Daily backups

Your school's data is backed up automatically every day, and the backups are kept off the main server, so losing a server does not lose your data.

Locked-down servers

A firewall opens only the ports PSM needs. The database cannot be reached from the internet, and security updates are applied regularly.

Monitored around the clock

Our systems are monitored 24 hours a day, 7 days a week, so problems are noticed and dealt with quickly.

Who can see what

Each school's data is kept separate. Every request is limited to the school it comes from, so one school's users cannot see another school's records.
Staff see what their role allows. Your school decides its roles and what each one may view or change.
A second pair of eyes on money. Sensitive actions such as refunds, payment reversals, removing fee charges and payroll can be set to need a second person's approval.
Parents see only their own children. A parent links to a child in the MyChild app with a code issued by the school, and sees that child alone.
Private files stay private. Learner and staff photos and documents are kept outside the public website and shown only to signed-in users of your school, and a child's photo only to that child's linked parents. Your badge and sign-in background are public by design.
A record of important changes. Changes to marks, fee structures, roles and permissions, payroll approvals and other sensitive actions are recorded in an audit log that your administrators can review under Settings > Security > Audit Logs.

Signing in and payments

Passwords are never stored as written. We keep only a salted hash, so nobody at PSM or at your school can read a password.
Repeated wrong passwords are stopped. After five wrong attempts an account is locked for five minutes, on the website and in the mobile apps.
Idle sessions end. A web session closes after an hour without activity, which protects shared computers.
We never send passwords. New staff set their own password from a link sent to their email, and no password ever appears in a message from PSM.
Mobile Money numbers are confirmed first. Before PSM sends a payment request to a new Mobile Money number, the number must be confirmed with a one-time SMS code.

Your data on your own server

Schools that prefer to keep their data on their own premises can run PSM on their own server, with the same features. PSM support installs and updates it for you.

Independent review and data protection

Third-party security audit

Our first independent security audit, by an outside firm, is scheduled for the end of October 2026. We will update this page when it is complete.

Registered with the PDPO

Axera Innovations (U) Limited, which builds and runs PSM, is registered with the Personal Data Protection Office (PDPO) of Uganda. How we collect, use and protect personal data is set out in our Privacy Policy.

Keeping your account safe

        Use a strong password that you do not use anywhere else.
Do not share your account. Ask your administrator for your own.
Sign out when you finish, especially on a shared computer.
Give each member of staff only the permissions their work needs.
Keep your phone number and email address up to date.
Tell your school administrator, or us, about anything that looks wrong.

    

Report a security issue

If you believe you have found a security weakness in PSM, please tell us straight away:

Email: security@psm.co.ug

Hotline: +256 39 3612767

We acknowledge every report promptly and keep you informed until it is resolved. Please give us the chance to fix an issue before you share it with anyone else, and do not access or change data that is not yours while investigating.