Security Annex — EduRegie
Annex to the data processing agreement: concrete technical and organizational measures (Art. 32 GDPR).
Technical measures
| Measure | Status | Explanation |
|---|---|---|
| Tenant separation per school | Implemented | Row Level Security in PostgreSQL/Supabase; every query is automatically limited to the school_id = current_school_id() of the logged-in user (see supabase/migrations/0002_auth_and_rls.sql) |
| Encryption in transit | Implemented | HTTPS/TLS for all traffic to the dashboard, the n8n webhooks and Supabase |
| Encryption at rest | Implemented | Standard encryption-at-rest of the Supabase/PostgreSQL hosting provider |
| Authentication | Implemented | Supabase Auth (email/password); no public self-registration — accounts are only created via invitation by a school administrator |
| MFA for sensitive roles | Implemented and enforced | Mandatory TOTP authentication (authenticator app) for the HR and school administrator roles; anyone not yet enrolled is redirected straight to the enrollment page on login (see middleware.ts and /dashboard/beveiliging) |
| Least-privilege roles | Implemented | Role-based navigation and server-side role checks in the dashboard (employee/operator/scheduler/teamlead/hr/substitute/admin); see components/DashboardNav.tsx and the per-page role checks |
| Audit logging | Implemented | audit_log table, populated by SF 21 - EduRegie Audit & Compliance |
| Service-role separation | Implemented | The n8n workflows use a service-role key that writes outside of RLS; every query in it filters on school_id itself (see the note at the bottom of 0002_auth_and_rls.sql) |
| Separated environments | Recommended | Use a separate Supabase project (or at least a separate demo school with demo_mode = true) for demos, separate from any future production environment |
| SSO (Microsoft Entra ID / Google Workspace / SURFconext) | Not yet implemented | Planned for phase 3 of the roadmap (docs/mvp-roadmap.md) |
Organizational measures
- No input option for medical data in the regular user portal; UI text explicitly points users to this (see
/dashboard/ziek-melden). - Access to the Supabase service-role key and the n8n environment is limited to the supplier (Elhoucine Automation) and, after delivery, the school administrator(s) designated by the school.
- New users are only added via an explicit invitation by a school administrator (no self-serve registration) — see
app/api/internal/gebruikers/uitnodigen/route.ts. - Demo mode (
demo_mode = truein the school settings) prevents notifications from going to real staff or students until the school gives written approval — seedocs/productie-runbook.md. - See
docs/incidentprocedure.mdfor the steps to follow in the event of a (suspected) data breach.
What is still missing for a full production security level
- Independent security review/pentest before the first paying production delivery to a school.
- Formal incident response exercise with the team.
- Extending MFA to the scheduler role if the school wishes — currently deliberately limited to HR/admin, the roles with the broadest view of staff data.