Your data is safe with Labbaik.

Payment security

All payments processed through Labbaik are handled entirely by Stripe — a PCI DSS Level 1 certified payment processor. This is the highest level of payment security certification in the industry. Labbaik never stores, sees, or touches card details. All sensitive payment data is transmitted directly to Stripe's certified servers and never passes through Labbaik's infrastructure.

Where your data lives

All Labbaik data — including student records, attendance logs, and parent information — is stored in London, UK, on Supabase, a platform that is independently audited and certified to the following standards:

All data is encrypted at rest using AES-256 and in transit via TLS. Sensitive documents — DBS certificates, payroll files and data exports — are kept in private storage and can only be opened through short-lived links that expire within an hour. The tokens that connect Zoom, Google Drive and Dropbox are kept in an encrypted vault.

The database is backed up automatically every day, and the backups stay in the same London region.

Your organisation, sealed off

Each institution's data is fully isolated from other organisations on the platform using row-level security (RLS) enforced at the database level — a Labbaik organisation can never access another organisation's data. We don't just rely on that being set up correctly once: automated isolation tests run on every change to the platform, checking that one organisation still can't reach another's data.

UK data protection

Labbaik Labs is registered with the Information Commissioner's Office (ICO) under UK GDPR. We process personal data — including student records and parent contact details — in accordance with UK data protection law. Your institution is the data controller; Labbaik is your data processor.

Every organisation is covered by our Data Processing Agreement from the day it signs up, on every plan, at no cost. It sets out the Article 28 terms your committee needs: we act only on your instructions, keep your data confidential, list every sub-processor and give 14 days' notice before adding one, help with subject access requests, and delete or return your data when you leave. Need a countersigned copy for your records? Email us and we'll send one.

Student data is never sold, never used for advertising, and never used to train AI models. The service providers that help us run Labbaik are named in our Privacy Policy and DPA, together with the safeguards that apply when any of them process data outside the UK.

If something goes wrong, we'll tell you without undue delay, and no later than 72 hours after we become aware of a personal data breach affecting your data — so you can meet your own 72-hour deadline for reporting to the ICO.

Access control

Access to data within Labbaik is role-based, and enforced at the database level — not just in the application — so it can't be bypassed. Admins can only see their own organisation's data. Teachers see the students in the classes they teach (or their department, where you organise staff that way), and can't change a student's contact, medical or billing details. Parents can only see their own children. Admins decide which extra permissions each member of staff gets, such as viewing contact details or logging payments — all off by default.

Safeguarding records are kept tight. Staff DBS records and certificates are visible only to admins and head teachers. Safeguarding reports are visible only to your leadership, the person who wrote them and the child's own teachers, and only an admin or head teacher can change their status.

A record of changes. Changes to attendance, progress, student records, registrations and admin access are logged with who made them and when, so admins can look back through that history.

Labbaik's own access. A small number of Labbaik staff can access organisation data, under a duty of confidentiality, only to give support you ask for, fix a problem or meet a legal obligation. When our support team views Labbaik as one of your users to help with an issue, the session is recorded.

Signing in

All authentication is handled by Supabase Auth, and nobody has a password: parents and students sign in with a magic link, Google or a one-time code on WhatsApp, and admins and teachers with a magic link, Google or a passkey. WhatsApp sign-in is never offered to staff accounts. Sign-in and public forms are protected by Cloudflare Turnstile bot checks and rate limits.

Admins and staff can also add extra protection to their own account, in Settings:

Two-step verification — after the magic link or Google, they enter a 6-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy. It's enforced by the database, not just the app, so someone who gets into their email still can't reach any data. Admins can require every member of staff to set it up.

Passkeys — sign in with Face ID, a fingerprint or the device's screen lock. A passkey only works on Labbaik, so it can't be phished.

Security alerts — we email the account holder whenever two-step verification is turned on or off, or a passkey is added or removed, so a change they didn't make stands out.

Sign out everywhere — every Sign out button, for staff and parents alike, asks whether to sign out of just this device or every device. Lost a phone, or left yourself signed in on a shared computer? One tap ends the account's sessions everywhere.

Third-party connections

Labbaik offers optional connections to Google Drive, Dropbox, and Zoom, using OAuth — the same industry-standard authorisation Google, Dropbox, and Zoom themselves use for third-party apps. Labbaik never sees or stores your password for these services; you authorise access directly with the provider, and you can revoke it at any time from your account settings or directly with the provider.

Each connection is scoped to the minimum access needed:

Google Drive — file-scope access only. Labbaik can only see files it creates on your behalf or that you explicitly select through the connection; we cannot browse, list, or access the rest of your Drive.
Dropbox — App Folder access only. Labbaik's connection is confined to its own dedicated folder inside your Dropbox; we cannot see or access any other files in your account.
Zoom — used only to create and manage video meetings for your classes and events on your organisation's behalf; it does not grant access to files or any other Zoom account data.

OAuth tokens are encrypted at rest in a vault, transmitted over TLS, and refreshed automatically without your login credentials ever passing through or being stored by Labbaik.

Your data, your control

The data you enter into Labbaik belongs to your institution — not to Labbaik. You retain full ownership of all student records, attendance logs, parent contact details, and financial information stored on the platform. There's no lock-in and no exit fee.

Export everything yourself, any time. Admins can download a ZIP of spreadsheet-ready CSV files from Account → Settings → Export data, without asking anyone. It covers everything your organisation records — students, attendance, payments and fees, classes, donations and Gift Aid, events, homework, exams, progress, staff, payroll, safeguarding records and tasks. The download link expires after an hour, and only your newest export is kept on our servers. Each area of Labbaik has its own CSV or PDF exports too, and parents can download their own payment history and their child's reports from the parent portal.

Want your uploaded files as well? The export covers your records; for a complete copy that includes uploaded documents, email [email protected] and we'll send it in a structured, machine-readable format within 72 hours, for any reason, free of charge.

Leaving. Admins can close the organisation from Account → Settings, and Labbaik offers an export before the final step so nobody leaves without their records. We delete its data within 30 days, keeping only what UK law requires — such as payment records and Gift Aid declarations for HMRC. See Delete your account for the details.

Moving in safely

Bringing records over from spreadsheets or another system with Hijrah is built to avoid mistakes. Your files are read in your browser and never kept. You check how each column has been matched before anything is saved, and review attendance, fees and payment history before they're imported. Students already on Labbaik are spotted and skipped unless you choose otherwise, rows that can't be imported are listed for you to download and fix, and you can undo an import step if something doesn't look right.

Reliability and support

Labbaik is built to be reliable. We target 99.9% uptime for all institutions on the platform, and the database is backed up automatically every day. Email support is available to all users with a target first-response time of 48 hours during business days. Manzil plan customers receive priority support with a target first-response time of 4 hours and a dedicated account manager.

How we hold ourselves to this

Labbaik runs on independently audited infrastructure: Supabase (SOC 2 Type 2 and ISO 27001) for data, and Stripe (PCI DSS Level 1) for payments. Labbaik itself hasn't yet been through its own external certification, such as Cyber Essentials, so we're specific instead: organisation isolation is tested automatically on every change, we carry out regular internal security reviews, and we'll answer your committee's security or data protection questionnaire in writing. Our DPA also gives you the right to audit how we meet it.

Found a security issue?

We take vulnerability reports seriously. If you've discovered a security issue in Labbaik, please contact us directly rather than disclosing it publicly. We'll acknowledge your report within 24 hours and keep you updated as we investigate.

[email protected]