Your college’s data, kept apart and accounted for.

Sepal Campus is multi-tenant: many colleges share the software, but every record carries its college and every query is constrained to it.

Isolation

Every table carries the college, and the data layer refuses any query that isn’t scoped to the caller’s college.
Each college has its own Google Identity Platform tenant, so sign-in, SSO configuration and user pools never mix.
Files are stored under the college’s own path in Cloud Storage, and security rules check the college claim on every read.

Single sign-on with Microsoft Entra ID, Okta or Google Workspace (SAML 2.0 or OIDC); multi-factor authentication is enforced by your provider. SCIM 2.0 creates and disables accounts from your directory.
Roles match how colleges work — registrar, department scheduler, dean, curriculum office, committee member, faculty, events, institutional research, assessment, workforce — and can be customized down to the permission.
Department and division scope limit chairs and deans to their own sections, courses and faculty for changes, while the shared schedule and catalog stay readable.
Sensitive fields — employee numbers, requesters’ personal phone numbers — are masked unless the user holds a specific permission, and every reveal is logged. Faculty credential documents are served only through short-lived signed links.
Approval routes skip anyone who submitted the request, so no one approves their own proposal, and segregation-of-duties rules flag conflicting roles.

Sepal Campus keeps aggregate enrollment — counts by section, course, program and term — not student records, which stay in your SIS. Program-path checks work from program maps, not individual students’ schedules.
We act as a school official under FERPA, sign your data-sharing agreement, and never use your data to train models or for any purpose but running your service.

Every create, change, approval, publish, export and reveal is written to an append-only audit log with who, when, from where and what changed.
The log is sealed daily with a hash chain so tampering is detectable.
Curriculum decisions keep their full record — every version, vote and comment — for accreditation reviews.

The app, the public catalog, schedule and events pages are built to WCAG 2.1 AA (and 2.2 where it adds), tested with keyboards and screen readers on every release.
A current VPAT (ACR) is available, and accessibility issues are fixed as defects, not feature requests.

Runs on Google Cloud (Firebase Hosting, Cloud Functions, Cloud SQL for PostgreSQL through Data Connect, Firestore) in US regions.
Encryption in transit (TLS 1.2+) and at rest; secrets are held in Secret Manager, never in code or configuration files.
Point-in-time recovery with a five-minute recovery point, cross-region backups, and restore tests every quarter.
Separate development, staging and production projects; every change is deployed from the repository, not by hand.

We’re glad to complete the HECVAT (Full or Lite), the SIG Lite or your own questionnaire as part of an evaluation.