Security guide

Multi Tenant

Self-serve cloud

Before you begin

Review the configuration and terms for the services your school actually uses.

School workspace boundaries#

Nexus school endpoints scope requests to the configured school and the authenticated membership. Class and resource checks further limit what a user can access.

Do not infer hosting isolation#

An application-level school boundary does not by itself establish a dedicated server, database, or cloud account. Confirm the hosting arrangement for your school with Nexus.

Review access#

Test student, teacher, operator, and unrelated accounts. Confirm that personal conversations remain separate from class review and that copied resource identifiers do not grant access.