Owl logoBUMA — Navigate · Think · Build · Succeed
BUMA

Security & Privacy

BUMA runs on Google Cloud Platform infrastructure, hosted in SOC 2 and ISO 27001-certified data centers, with continuous backups, end-to-end encryption in transit and at rest, and annual third-party security audits at the infrastructure level. On top of that, we've built our own application-level protections specifically for school data — role-based permissions, full audit logging of sensitive actions, encrypted national ID storage, and two-factor authentication for administrators. We take data isolation between schools extremely seriously and test it regularly.

Infrastructure

  • Google Cloud PlatformInfrastructure
  • SOC 2 Type IIAudited annually
  • ISO 27001Certified data centers
  • BUMA is built and hosted on Emergent's platform, running on Google Cloud Platform (GCP), inside SOC 2– and ISO 27001–certified data centers.
  • Continuous backups with industry-standard recovery objectives, designed to minimize downtime and data loss.
  • All traffic encrypted end-to-end in transit; databases encrypted at rest with secure key management.
  • Real-time security monitoring, centralized logging with one-year retention, and annual SOC 2 Type II audits at the infrastructure level.

Built Into BUMA Itself

On top of this infrastructure, BUMA has its own application-level protections, built specifically for school and family data:

  • Role-based access — every user (admin, teacher, finance staff, parent) sees only the data relevant to their role.
  • Full audit trail — every sensitive action (payment edits, permission changes, record deletions) is logged: who, what, when.
  • Encrypted national ID numbers — masked by default, viewable only via a deliberate, logged "Reveal" action.
  • Two-factor authentication for enterprise administrators (email + password + one-time code).
  • Strict data isolation — one school's or center's data is never visible to another organization on the platform.
  • Soft-delete safeguards — records move to a recoverable Bin before any permanent deletion, with restore available.

Our Commitment to Families

BUMA's Terms & Conditions set out clear commitments on consent, data retention, and deletion rights for children's data — with organizations enrolling students responsible for obtaining appropriate parental consent, in line with applicable local law.

A Note on Honesty

Platform-level certifications (SOC 2, ISO 27001) belong to our infrastructure provider and describe the security of the servers BUMA runs on. They are one part of a layered approach — paired with the application-level protections built specifically into BUMA, described above. We review and test our own data-isolation and access controls on an ongoing basis, and take any finding seriously and act quickly.

Read the Terms & Conditions