--- title: "Security and Governance Posture | Fairhelm Systems" description: "Fairhelm Systems' security posture covers RBAC, auditability, least privilege, tenant separation, secure cloud deployment and privacy-first data handling." canonical: https://fairhelmsystems.com/security/ describedby: https://fairhelmsystems.com/llms.txt --- Security · Privacy · Governance # Trust is an architecture, not a badge. Fairhelm Systems approaches security through explicit authority, least privilege, auditable action, protected data boundaries and cloud operations designed to remain predictable under scrutiny. [Discuss security requirements](https://fairhelmsystems.com/contact/) · [Read privacy posture](https://fairhelmsystems.com/privacy/) - Role-based access and least privilege - Audit trails for material action - Tenant separation as architecture - No unearned certifications claimed [Overview](https://fairhelmsystems.com/legal/) · [Privacy](https://fairhelmsystems.com/privacy/) · [Terms](https://fairhelmsystems.com/terms/) · [Acceptable use](https://fairhelmsystems.com/acceptable-use/) · [AI policy](https://fairhelmsystems.com/ai-policy/) · [Data processing](https://fairhelmsystems.com/data-processing/) · [Refunds](https://fairhelmsystems.com/refund-policy/) · [Security](https://fairhelmsystems.com/security/) 01 Core principles ## Governed access. Traceable action. Clear data boundaries. The exact control set depends on product maturity, deployment scope, customer requirements and contract. These principles define the direction of travel. ### Role-based access control Access should follow explicit roles, scopes and responsibilities rather than convenience or broad defaults. ### Auditability Material actions and sensitive interactions should produce intelligible, reviewable records. ### Least privilege People, services and automation receive only the access necessary for the approved operating purpose. ### Tenant separation Customer and institutional boundaries are treated as architectural concerns, not naming conventions. ### Secure cloud deployment Encryption, controlled network paths, managed secrets, monitored services and recoverable operations guide deployments. ### Privacy-first handling Collection, use, retention, sharing and deletion should remain proportionate, explicit and governed. 02 SquareCampus data commitments ## Student, parent and institutional data are not inventory. Our product posture starts from customer ownership and explicit permission. ### No selling student or parent data Fairhelm does not treat personal or institutional data as a hidden monetisation stream. ### No training AI on customer data by default Customer data will not be used to train AI systems unless that use is explicitly contracted and governed. ### Customer data belongs to the school or trust The customer retains ownership; Fairhelm acts only within the agreed service and processing scope. ### No governance bypass Intelligence and automation are designed to respect role, scope, approval and audit requirements. 03 AEGIS controls ## Governed intelligence begins with deliberate limits. AEGIS is read-only first, RBAC-aware, audit-backed and explainable. Autonomous writes are outside the v1 posture. No fake compliance claims This page is a public security and governance posture. It is not a certification, audit report, data processing agreement, security addendum or warranty. Contract-specific controls must be documented in the relevant agreement. 04 Insights ## Practice notes on this work. [All insights](https://fairhelmsystems.com/insights/) Governance 18 August 2026 ·9 min read ### [Designing audit trails people can actually read](https://fairhelmsystems.com/insights/audit-trails-people-can-read/) Most systems log everything and explain nothing. An audit trail is for a principal, a finance head or an auditor, not for a database. How to design one that answers who, what, when, why and under whose authority, in plain language. Read the note 05 Frequently asked ## Security questions, answered without overclaiming. Certification, data ownership, access control, AI boundaries and how to report a concern. ### Is Fairhelm Systems certified under ISO 27001 or SOC 2? This site claims no security certification. The security page describes design posture, not a certification, audit report or warranty; contract-specific controls are documented in the relevant agreement. ### Who owns the data in SquareCampus? The customer institution. The product posture starts from customer ownership and explicit permission: student, parent and institutional data are not treated as inventory. ### How is access controlled? Through role-based access control and least privilege: people, services and automation receive only the access their approved purpose needs, and material actions produce reviewable audit records. ### Does AI act on its own inside SquareCampus? No. AEGIS is read-only first, RBAC-aware, audit-backed and explainable; autonomous writes are outside the v1 posture, and human approval stays decisive. ### How do I report a security concern? Write to hello@fairhelmsystems.com with the details. The same address handles Data Principal requests under the Digital Personal Data Protection Act, 2023. Continue [Legal · Privacy policy · The Data Fiduciary, categories of personal data, retention and Data Principal rights.](https://fairhelmsystems.com/privacy/) · [Legal · Legal and governance center · Every public policy, indexed, with the publishing entity named.](https://fairhelmsystems.com/legal/) Next move ## Bring security into the system conversation early. Share the data classification, roles, deployment constraints, audit needs and customer obligations before architecture hardens. [Discuss governance requirements](https://fairhelmsystems.com/contact/) · [Read the privacy policy](https://fairhelmsystems.com/privacy/)