Security and POPIA
ADAM controls who sees each piece of information, protects staff sign-in with a second factor, and stores your school's data in data centres in South Africa.
Staff sign-in protected by a second factor
From January 2027, two-factor authentication is compulsory for all staff logins.
ADAM uses an authenticator app and gives each person ten single-use recovery codes. Your school chooses whether ADAM challenges staff at every sign-in, once for each computer, or once a day for each computer. An administration screen shows who is enrolled and who is not. Staff can sign out remembered computers if a laptop goes missing.
| Staff member | Two-factor | Sign-in methods |
|---|---|---|
| Ms Fourie | Enrolled | Authenticator app, passkey |
| Mr Dlamini | Enrolled | Authenticator app |
| Mrs Naidoo | Not enrolled | Password only |
Signing in
- Passkeys sign in with a fingerprint, face, PIN or security key instead of a password. They resist phishing. Staff, parents and pupils can use them, and dashboard prompts encourage people to enrol.
- Your existing accounts. ADAM can authenticate against your Active Directory or LDAP server, or through Google or Microsoft sign-in.
- Passwords are stored as a one-way hash, never as readable text. ADAM checks new passwords against lists of passwords exposed in earlier data breaches, without disclosing the password.
- Lockouts. Repeated wrong passwords or wrong codes lock that single account briefly. The lock clears itself.
- Password resets. A reset link for a parent is valid for 24 hours and works once.
Read how ADAM checks passwords
Who can see what
A strict privilege system controls access. Staff see only the features their roles give them. You can mark individual fields as sensitive and limit who sees them.
Parent and pupil logins are separate from staff logins. They have read-only access to a few features, scoped to their own family. A school-wide list of accepted file types controls what staff and families can upload.
ADAM keeps an audit trail. The change log records data changes across the system. Mark change history covers the academic record. The site settings history records who changed which setting, and never records sensitive values such as passwords.
Your data
ADAM stores your school's data in data centres in South Africa.
Backups are encrypted with a long, random password that is unique to each school. For schools on our hosting platform, a copy of each backup goes off site every day. We store the passwords separately from the backups.
On the hosting platform we expose only the web service and the remote management service. Remote management uses an encrypted channel with certificate authentication, and password logins are disabled. We patch the servers with security releases regularly, and they redirect insecure access to HTTPS.
When we test software, we replace names, ID numbers, phone numbers and email addresses with random data first.
POPIA
ADAM includes tools that help your school comply with the Protection of Personal Information Act (POPIA). With ADAM you can:
- remove old data from your database;
- limit which staff can see which information, including fields you mark as sensitive;
- respond to requests for information.
The school is the responsible party under POPIA. ADAM supports the school in that role, and ADAM EduTech makes no warranty that a school complies with the Act. The law is still developing, so these features may change at short notice.
Read the full POPIA declaration
Report a security issue
If you find a security problem in ADAM, tell us. How to report a security issue