Role-based permissions
Roles and explicit grants control module access and actions. Staff branch grants narrow operational scope; teacher workflows enforce assigned-class access.
Security & architecture
Designed around
clear access boundaries.
School records need context. Latticework combines application permissions, branch and academic-session checks, and database row-level policies.
School→Branch access→Academic session→Authorized action
Database isolation
Tenant tables use forced PostgreSQL row-level security. The documented runtime database role has no row-level-security bypass privilege; request context is set within transactions.
Parent-child authorization
Parent services check school membership and the linked child. Student document access checks ownership and current visibility at the download boundary.
Audited workflows
Sensitive operational changes record actor and context. Gate handover, hostel movement and other transactional workflows couple operational changes with their audit records.
School-owned integrations
Payment and messaging settings are resolved for each school. Provider secrets are encrypted at rest in integration settings; diagnostic history presents redacted outcomes.
Payment verification
Checkout verification checks the provider payment against the stored order, amount, currency and school. Signed webhooks and conditional updates help prevent duplicate fee credits.
A connected architecture
Purpose-built layers.
Shared context.
The web application connects to an Express API and PostgreSQL through Prisma. Redis and background workers support queued operations, including durable transport draft jobs.
Web workspaces School · Staff · Parent
↓ Authenticated requestsApplication API Permissions · Validation · Workflow rules
↓ Scoped transactionsPostgreSQL School data · Row-level policies · Audits
Deployment & acceptance
Security is also
an operating practice.
Production setup needs HTTPS, controlled credentials, backup and restore procedures, retention policies and provider acceptance testing. Review these with your deployment team before introducing real school records.
What these descriptions mean
They describe implemented controls and documented architecture. They are not a claim of independent certification, guaranteed uptime, a completed security audit or production release approval.
For deployment questions or to report an issue, contact hello@latticework.school. Do not email credentials or student records.
Your school. Your workflows.
See how it all connects.
Walk through the modules, roles and setup your institution needs.