A school holds children's records. That deserves specifics, not adjectives.
Everything below is a property of how the system is built, which is why it can be described precisely rather than promised generally.
Isolation enforced twice
Application scoping and Postgres row-level security. A bug in one is caught by the other.
Append-only money
Fees, payroll and the ledger are never edited. Corrections are dated reversals, so every rupee stays traceable.
Full audit trail
Who did what, when, and from where — including who overrode a rule and the reason they gave.
Built for Pakistan
PKR, PKT, the 1 July fiscal year, FBR withholding, provincial sales tax, EOBI and PF — not a template with the currency changed.
Enforced twice, on purpose
Every record belongs to an institute and a campus. Scoping is applied by the application and again by Postgres row-level security, so a mistake in the first is caught by the second. One layer is a policy; two layers is a guarantee you can test.
- Institute and campus on every row, enforced at the database
- Per-user campus grants, independent of role
- Granular permissions on every screen, action, export and report
- Past sessions read-only behind their own permission
- Portals are strict — no role can open another role's surface
- Two-factor login; a password change revokes every other device
Money and records cannot be quietly rewritten
- Fees, payroll and the ledger are append-only — corrections are dated reversals
- Amounts are integer paisa, so no rounding drift is possible
- Attendance registers lock, with a documented correction request and approval
- Overrides record who granted them and the reason they gave
- A full audit log of who did what, when and from where
Your data stays yours
- Your institute connects its own SMS and email gateway — nothing is sent from an Ilmora address in your name
- Your data is never pooled with other institutes
- Your data is not used to train AI models
- Exports available in CSV and PDF at any time
- Encrypted in transit; access to production is restricted and logged
Responsible disclosure
If you have found a vulnerability, write to help@ilmora.cloud with enough detail to reproduce it. We acknowledge within one working day, keep you updated while we fix it, and will credit you if you would like us to.
See Ilmora on your own data
A 30-minute demo with someone who knows the product. We will set up your institute properly afterwards — nobody self-serves their way into a broken configuration.