NuPay
Log in Book a Demo
Security

Security starts with what NuPay never holds.

The safest money is money that stays in the bank. NuPay is built so school funds, card details and banking passwords never pass into our hands, and so every figure in the books can be traced back to where it came from.

Book a Demo How it is built
  • School funds settle in the school’s own bank account
  • Card and wallet details stay with the payment gateway
  • Every action is recorded and can be traced
  • Encrypted, backed up daily and protected by two-step sign-in
Secure by design

Your money’s safest place is your bank. So we leave it there.

NuPay handles the information about a payment. The institutions built to hold money handle the money.

Integrity of the books

Records that cannot be quietly changed

Most losses in a school accounts office are not break-ins. They are entries altered after the fact. NuPay is built so that a correction always leaves a mark.

  • Reversed, not erased. A posted invoice or bill is voided with a reversal entry. The original stays on the record.
  • Paid invoices are protected. Once money has been received against an invoice, it cannot be edited or voided out from under the payment.
  • Drafts before posting. Invoices, bills, journals and bank allocations can be prepared as drafts, and reach the ledger only when they are posted.
  • Approved rates lock. An exchange rate, once approved, is fixed for the transactions that used it.
  • Double-entry throughout. Every transaction has two sides, so the books have to balance.
Traceability

Every action leaves a trail you can read

School finance is audited by people who did not enter the transactions. NuPay’s Data Flow view shows them, action by action, exactly what the system did.

  • Every action is recorded as it happens, with what it wrote and where.
  • Field-by-field changes. See the value before and the value after.
  • From report to source. A figure on a report leads back to the journal, the payment and the student.
  • Exportable. Any single event can be exported for an auditor or an investigation.
NuPay Data Flow screen: a traced action listing the tables written, with the actual rows removed and inserted shown column by column.
Data Flow in NuPay: every action traced to the tables it wrote and the rows it changed.
Infrastructure

Where your records live, and how they are protected

The school’s records are held on infrastructure built for banks and governments, close to home.

Hosting
AWS Africa (Cape Town)
In transit
TLS 1.2 or higher
At rest
AES-256
Backups
Daily, at 00:00
Sign-in
Two-step
Access, testing and data protection

The rest of what keeps a school’s records safe

Shared responsibility

What we look after, and what the school does

Good security is a partnership. A system can record who did what, but only the school can decide who should be allowed to.

NuPay’s part

Built into the product.

  • Keeping school funds, card details and banking passwords out of NuPay
  • Recording every action, with who did it and when
  • Protecting posted and paid records from silent changes
  • Encrypting the school’s records and backing them up every day

The school’s part

Good habits that no software can do for you.

  • Give each person their own login and second step, and never share them
  • Give each role only the access the job needs
  • Remove a user’s access the day they leave
  • Review the audit trail and reconcile to the bank regularly
Seen something that worries you?Report a security concern and we will look into it straight away.
Contact us
If something goes wrong

A breach is handled in the open, not in silence

No system can promise it will never be attacked. What we can promise is what happens next.

  1. 1

    Contain

    We isolate the affected systems, revoke the access involved and stop the incident from spreading.

  2. 2

    Assess

    We establish what happened, which schools are affected and what information was involved.

  3. 3

    Notify

    We tell each affected school and the Data Protection Authority within 24 hours of confirming a breach, and help the school inform the parents and students concerned.

  4. 4

    Fix and report

    We close the gap, restore from backup if records were damaged, and give the school a written account of what happened and what has changed.

Because NuPay never holds school funds or card details, a breach of NuPay cannot empty a school’s bank account or expose a parent’s card.

FAQs

Does NuPay hold our school’s money?

No. Payments settle directly in the school’s own bank account. NuPay never holds school funds; it reads the transaction so it can match it and keep the books.

Can NuPay move money out of our bank account?

No. The bank connection gives NuPay information about transactions on the accounts the school has authorised. It cannot make payments or transfers.

Does NuPay store parents’ card details?

No. Parents enter card numbers and wallet PINs with the payment gateway. NuPay receives the result of the payment, not the card.

Can someone delete or change a transaction after it is posted?

Not silently. A posted invoice or bill is voided with a reversal entry and the original is kept. An invoice that has a payment against it cannot be edited or voided.

Where is our data stored?

On Amazon Web Services, in the Africa (Cape Town) region. Stored data is encrypted with AES-256, and everything sent between your browser and NuPay is encrypted with TLS 1.2 or higher.

Is our data backed up?

Yes. A full backup is taken every day at midnight and stored encrypted, so records can be restored if something goes wrong.

Is a password enough to sign in?

No. NuPay uses two-step sign-in, so a stolen or guessed password is not enough on its own.

What happens if there is a data breach?

We contain it, establish what was affected, and notify each affected school and the Data Protection Authority within 24 hours of confirming it. We then help the school inform the people concerned and give a written account of what happened and what has changed.

What can our auditors see?

The full trail. Every action is recorded, and the Data Flow view shows what each action wrote and what changed, down to the field. Any event can be exported.

Who can see our school’s data?

The users the school has given accounts to, within the access their role allows. The school owns its data, and NuPay uses it only to provide the service, as set out in our privacy policy.

How do we report a security concern?

Contact us straight away. If you suspect someone has accessed an account they should not have, tell us and remove that user’s access.

See the trail for yourself

We’ll post a payment in front of you and show exactly what the system recorded.

Book a Demo Privacy policy