Security & privacy
How we look after your pupils’ details.
Bus Register holds pupils’ names, their bus and stop, and their parents’ phone numbers. Here is what we do to keep them safe, in plain words, for your data protection officer.
Every school kept apart
Each school has its own address (yourschool.busregister.com), its own accounts and its own data. An account only works at its own school’s address, and every request only ever reads that school’s records.
Only who needs to see it
You decide who can do what, with roles you set up yourselves: a prefect sees their own bus’s pupils and nothing else. Nobody can give themselves more than they have, and nobody at another school sees anything of yours.
Support only with your permission
Bus Register staff can only open your school if your settings allow it. They give a reason each time, can stay an hour at most, and every visit shows on your dashboard and in your activity log.
Strong sign-in
Passwords are never stored, only a one-way hash. Temporary passwords must be changed at first sign-in. Accounts lock after repeated wrong passwords. Our own staff can add a code from an authenticator app to their sign-in.
Encrypted on the way
Every page is served over HTTPS, and browsers are told never to use plain HTTP. Sign-in cookies only travel encrypted and can’t be read by scripts.
A firewall in front
Scanners, attack attempts, password guessing and floods of requests are blocked before they reach your data, without ever slowing down your prefects or coordinators.
No trackers, no adverts
No advertising, no third-party analytics, no tracking cookies. Our page statistics are counted on our own server with an anonymous ID that changes every day.
Everything on record
Your activity log shows who did what at your school: registers submitted, prefects created, passwords reset, imports and support visits.
Where your data is
In France. The site and its database are hosted by LWS (Ligne Web Services), in data centres in France. Your school’s data stays there, in the European Union; we don’t copy it to other services. Or, if you prefer, keep your pupils’ data in your own database while Bus Register runs for you here.
A few things leave the site, never with pupils’ details:
- Addresses of bus stops, typed by your coordinator, are looked up on the map with the French government’s address service (IGN Géoplateforme) or, outside France, Photon on OpenStreetMap.
- The positions of your stops are sent to Valhalla, a routing service on OpenStreetMap run by FOSSGIS, to draw the road the bus takes.
- Map images are loaded by your browser from OpenStreetMap.
Addresses seen by our firewall are located on our own server, with a database we keep there: no address is sent anywhere to find out where it is.
Who is responsible for what
Your school decides what pupils’ data goes into Bus Register and why: it is the data controller. Bus Register processes that data on your behalf, only to run the service, under the EU GDPR and, for UK schools, the UK GDPR and the Data Protection Act 2018; we sign a data processing agreement with every school. See our privacy policy for the details, and the terms of service.
When you leave
Export your registers to Excel whenever you like, or download all your school’s data in one file from its Data & privacy page. When your school stops using Bus Register, we delete its data for good: its accounts, buses, pupils, registers and activity.
Found a problem?
If you think you’ve found a security problem, please tell us at contact@busregister.com before telling anyone else. We’ll answer quickly and keep you informed.
See your own buses in Bus Register.
Tell us about your school: we reply by email with a free trial set up with your routes, and answer your questions.