Children’s records deserve a straight answer to four questions: where the data lives, who can read it, what happens the day you leave, and what we have not finished. All four are below, including the last one.
Every authorised open mints a signed link that expires in ten minutes. Authorised removal deletes the record and stored bytes.
Ariadne requires authenticated organisation membership; tool actions still pass their own permission, scope and approval checks.
Guarded writes and designated sensitive reads append receipts. Update and delete are blocked by database triggers.
One live consent per combination. Withdrawal is a timestamp, never a deletion, and guardianship is recorded before consent is asked for.
It exists, expires in an hour, and asks for your reason — which goes into the log with your name on it.
At any time, on any plan, in any billing state. Every table must be present, uncapped and readable before closure can be scheduled.
ResidencyConfirm the contractDocumentsPrivate, signed accessPermissionsPer field, per roleThe logAppend-onlyConsentWithdrawable, never deletedLeavingPortable tables, readable without usResidencyConfirm the contractDocumentsPrivate, signed accessPermissionsPer field, per roleThe logAppend-onlyConsentWithdrawable, never deletedLeavingPortable tables, readable without usThe logAppend-onlyConsentWithdrawable, never deletedLeavingPortable tables, readable without usResidencyConfirm the contractDocumentsPrivate, signed accessPermissionsPer field, per roleThe logAppend-onlyConsentWithdrawable, never deletedLeavingPortable tables, readable without usResidencyConfirm the contractDocumentsPrivate, signed accessPermissionsPer field, per role
The product does not promise self-service region selection, an annual migration interval or a universal notice period. Audecius must confirm the approved terms for the organisation before signing.
The document bucket is private. Authorised access is resolved against the current student and organisation relationship rather than a permanently public object address.
Every open mints a signed link that expires in ten minutes. Four policy paths cover the student, staff of the owning organisation, the coordinator on the student’s placement and the designated partner path.
Authorised staff can remove a document. The guarded operation deletes the record first and then its stored bytes; a cleanup worker handles a leftover private object if the second step is interrupted.
The first segment of every object name is the subject of the file — the only part of a filename a policy can trust, since the rest is chosen by whoever uploaded it.
Medical and allergy detail, contact details, academic records and incident reports can have different readers. Authorised administrators adjust visibility; server-side policies still govern sensitive operations.
Chat requires authenticated organisation membership. Tool actions separately enforce tenant scope, permission, consequence class and approval before they can write.
Break-glass exists, expires in an hour, and asks for your reason — which goes into the log with your name on it.
“A log you can edit is a log nobody should have trusted.”
Guarded changes and designated sensitive reads leave a receipt.
Actor, action, entity and timestamp are recorded for guarded writes and designated sensitive reads. Audit rows are append-only: update and delete are blocked by database triggers. The page does not claim that every read or every denial is captured until that coverage is evidenced.
Granted for a subject, by a grantor, for a kind, in a jurisdiction — with its evidence, and one live consent per combination at a time.
Withdrawal is a timestamp, never a deletion. The history of what was agreed and when survives the withdrawal.
Guardianship is recorded before consent is asked for, not inferred from it afterwards. Why can this adult read this child’s file must always have an answer.
The jurisdiction decides the age threshold, not us. A student below it cannot finish signing up alone; the account is created and held, and nothing personal is stored while it is held.
Two-factor cannot be switched off for any role that can open a minor’s record.
“The organisation loses access. The student does not.”
What no lock-in has to mean to be worth saying.
At any time, on any plan, in any billing state — including thirty days past due.
People, placements, the document register, incidents, support history, broadcasts and the family ledger as CSV files, plus a machine-readable manifest. Document bytes are not copied into this browser archive and must be retrieved separately.
A fresh receipt for every offered table is required first; capped or refused files do not count. Active students, placements, safety cases, support work, connected apps and billing all block closure.
Closure is scheduled, not deletion. There are thirty days to cancel, then the server checks every blocker again. People keep their accounts and the organisation’s historical records remain retained.
If a specific certification, clause or date decides your purchase, ask before you sign. You will get the real answer, in writing.