How Bell Path protects school data
School data is stored in Australia, and each school sees only its own. A few services named below work overseas, including the AI from Anthropic and OpenAI in the United States that reads the timetables schools send. Where something is not in place yet, such as a security certification, this page says so. Written for whoever checks new software for your school.
Our approach
Bell Path holds staff names, timetables and cover plans. If a school chooses, it also holds short student support instructions for the relief teacher covering a class, which only the school’s health lead or administrators can write. A teacher using Bell Path on their own can also leave notes about their students in the plan they send the relief teacher taking their class.
Who can see what
- Everyone signed in to a school’s Bell Path account has a role in that school, and the role decides what they can view or edit.
- A booked relief teacher opens the day’s outline from the private link made for that booking, with no account or code. The outline holds nothing sensitive.
- Protected class handovers, student support instructions, restricted files and the School access vault open only once the relief teacher shows they have the phone the booking went to.
- Each support staff member’s day link opens with no account or code, so anyone the link reaches can open it. It shows only that person’s own day, with students as initials. It works until the end of the school year it was made for (one made in Term 4 lasts to the end of next year). The school can turn it off any day, and taking the person off the staff list deletes it.
- A teacher's own plans open from a personal link Bell Path sends them. When they send a plan, notes about students, logins and files marked as holding student information open only on the relief teacher's own link, after a four-digit code texted to the relief teacher's mobile. Every other link to the plan leaves them out, and every plan link stops working after the last day away.
- A relief teacher on more than one school's list is matched by mobile number, so once one school books them, another school asking who is free sees them as no longer available, without learning where.
- An expiring teacher contribution link opens only the date, class or session that teacher owns. The resource shelf code opens lesson resources only and cannot unlock student support instructions or the School access vault.
- Only the people who run Bell Path can use its own administration tools, and their access to sensitive parts of a school's Bell Path account is recorded.
- Schools should remove staff who no longer need access, and tell us straight away if they think an account has been compromised.
How data is protected
- All traffic between your browser and Bell Path is encrypted using HTTPS, the padlock standard every bank website uses.
- The server checks every request itself. Before it returns school records it confirms the person asking is a member of that school.
- Passwords are never stored as typed. We store a scrambled version that cannot be turned back into the password.
- School staff sign in with two steps. After the password, Bell Path emails a six-digit code when someone signs in on a browser it has not seen for them, then remembers that browser for 30 days. Changing the password forgets every remembered browser.
- Card payments are handled on pages run by Stripe, our payment provider. Bell Path never sees or stores card numbers.
- Files attached to class handovers enter a quarantine storage bucket, are scanned for viruses before use, then move to a protected storage bucket. Both buckets are in Sydney and the scanning runs in Melbourne. The storage provider encrypts them at rest. Reusable school-issued credentials for relief or casual teachers stay in a separate encrypted vault and are never printed.
- Error monitoring and logs help us find reliability and security problems quickly.
Where school data is kept, and who helps run Bell Path
Bell Path is an Australian business run from Victoria, and its servers are in Australia, in Melbourne and Sydney.
| Company | Where | What it holds |
|---|---|---|
| Cloudlets (VPSBlocks) | Melbourne | The website you sign in to, the database holding your school information, the timetable generator, virus scanning of uploaded files, and the scheduled jobs that send notices and publish cover |
| Amazon Web Services | Sydney | Storing the files staff upload for the teacher covering a class, for encrypted database backups and for receiving planners emailed to Bell Path |
| Company | Where | What it does |
|---|---|---|
| Stripe | The United States, India and other countries | Payment processing, hosted checkout, invoices, and subscription records |
| Resend | The United States and Japan | Sending Bell Path's emails |
| Microsoft | Australia | The hello@bellpath.com.au mailbox, which holds the emails, support requests and attachments schools send us |
| ClickSend | Australia, the United States, the United Kingdom, New Zealand, Brazil, Vietnam and the Philippines | Text messages Bell Path sends: a school's texts to its relief or casual teachers and cover planners, and a teacher's plan, its code and their own link, to the numbers the teacher gives |
| The United States and other countries | Advertising measurement on public pages, unless a visitor stops it; Google Drive, where a planner keeper chooses to link a planner (Bell Path can open only the files that person picks, reads them when they change, and can save a Word planner to that person's own Drive); the YouTube player for Bell Path's training videos; and checking whether a Google Docs, Drive, Sites, Classroom or Forms link a teacher adds to a plan opens for someone who isn't signed in, which Bell Path does by opening only that link | |
| Meta | The United States and other countries | Advertising measurement on the teacher page (bellpath.com.au/relief-plan) when Bell Path runs ads to teachers on Facebook or Instagram, unless a visitor stops it |
| OpenAI | The United States | Reading a file a school gives Bell Path when Bell Path cannot read it itself: a PDF or photo, or a Word or Excel file Bell Path's own reader cannot follow (staff lists, existing timetables, school setup documents, term planners and support staff rosters), and a term planner the school emails to its Bell Path planner address or links from Google Drive, which is read each time it arrives or changes. OpenAI doesn't use it to train its models. Bell Path asks OpenAI not to store it; OpenAI may keep it for up to 30 days to check for misuse, or longer if the law requires. AI reading is on for every school, and switching it off in Settings stops all of the above. OpenAI also turns a voice recording on a teacher's plan, by the teacher or the relief teacher, into text. Bell Path keeps only the text they save, not the recording. OpenAI doesn't use the recording to train its models, and may keep it for up to 30 days to check for misuse |
| Anthropic | The United States | AI help with running and supporting Bell Path, whether AI reading is on or off in Settings. Anthropic's AI, Claude, loads a school's timetable when the school sends us its timetable files or the upload page sends us a file Bell Path cannot read itself, and helps us answer emails schools send us and look into problems they report. It sees the files, emails and school records involved, such as staff names, classes, subjects and times. Anthropic doesn't use any of this to train its models unless it is flagged for a safety review, and keeps it for as long as it reasonably needs to, up to two years if it is flagged, or longer if the law requires |
Email, text messages, payments and the AI that reads timetable files come from separate companies, some of them outside Australia. The AI is from Anthropic and OpenAI, in the United States, and reads what a file holds, such as staff names, classes, subjects and times.
For a privacy review, record that Bell Path involves some processing outside Australia.
For a printable version for a principal or business manager, see the School Approval Pack. It includes the risks a school should weigh up.
Answering school security reviews
Many schools must run a security review before using new software, often using the Safer Technologies 4 Schools (ST4S) question set. Bell Path keeps the answers to those questions ready: what data we hold, which providers we use, who can access what, what can be shared publicly, how data is kept and deleted, and how to enter as little personal information as possible.
Bell Path does not currently hold an external certification such as ST4S, ISO 27001 or SOC 2, so this material helps a school complete its own review. It is not an ST4S badge, assessment result, Department endorsement or sector approval, and we do not describe it as one.
Before you enter live data
Schools should complete their own purchasing, privacy, security and sector approval checks before entering live school data. Send security and data handling questions to hello@bellpath.com.au.
Bell Path is specialist timetabling and planning software that sits beside the systems your school, diocese or Department provides. It does not replace them. It is worth confirming whether your sector already provides something equivalent before you buy.
Backups and recovery
We back up the database regularly, encrypt the backups, and test restoring from them. Backups are kept for a limited time and then deleted automatically.
You can check whether the app, database, background jobs and timetable generator are healthy at any time on the System status page.
Schools should keep their own copies of important exports and published timetables, in line with their record-keeping policies. During a busy timetable, staffing or cover period, export the current published timetable and any critical cover sheets so you have them if the service is unavailable.
Uptime and service levels
Bell Path is provided as available, with no uptime guarantee. A service level agreement (an uptime percentage, response times or credits) needs a separate written agreement.
If something goes wrong
If we become aware of a security incident affecting school data, we investigate and take reasonable steps to contain it. Where a breach is likely to cause someone serious harm, we notify the people affected and the Office of the Australian Information Commissioner, following the Notifiable Data Breaches scheme.
Reporting a security concern
If you suspect a security issue, unauthorised access, an exposed password or a data handling problem, email hello@bellpath.com.au with enough detail for us to investigate.
Security researchers can find the same contact in our security.txt file.
Ready to see it with your own timetable?
Send the timetable you already have and we load it for you, free, within 48 hours.
