BUMA runs on Google Cloud Platform infrastructure, hosted in SOC 2 and ISO 27001-certified data centers, with continuous backups, end-to-end encryption in transit and at rest, and annual third-party security audits at the infrastructure level. On top of that, we've built our own application-level protections specifically for school data — role-based permissions, full audit logging of sensitive actions, encrypted national ID storage, and two-factor authentication for administrators. We take data isolation between schools extremely seriously and test it regularly.
Infrastructure
Built Into BUMA Itself
Our Commitment to Families
A Note on Honesty
Cookies & Analytics on This Website
Google Cloud Platform Infrastructure
SOC 2 Type II Audited annually
ISO 27001 Certified data centers
BUMA is built and hosted on Emergent's platform, running on Google Cloud Platform (GCP), inside SOC 2– and ISO 27001–certified data centers.
Continuous backups with industry-standard recovery objectives, designed to minimize downtime and data loss.
All traffic encrypted end-to-end in transit; databases encrypted at rest with secure key management.
Real-time security monitoring, centralized logging with one-year retention, and annual SOC 2 Type II audits at the infrastructure level.
On top of this infrastructure, BUMA has its own application-level protections, built specifically for school and family data:
Role-based access — every user (admin, teacher, finance staff, parent) sees only the data relevant to their role.
Full audit trail — every sensitive action (payment edits, permission changes, record deletions) is logged: who, what, when.
Encrypted national ID numbers — masked by default, viewable only via a deliberate, logged "Reveal" action.
Strict data isolation — one school's or center's data is never visible to another organization on the platform.
Soft-delete safeguards — records move to a recoverable Bin before any permanent deletion, with restore available.
BUMA's Terms & Conditions set out clear commitments on consent, data retention, and deletion rights for children's data — with organizations enrolling students responsible for obtaining appropriate parental consent, in line with applicable local law.
Platform-level certifications (SOC 2, ISO 27001) belong to our infrastructure provider and describe the security of the servers BUMA runs on. They are one part of a layered approach — paired with the application-level protections built specifically into BUMA, described above. We review and test our own data-isolation and access controls on an ongoing basis, and take any finding seriously and act quickly.
The public BUMA Academy website (buma.academy) uses the Meta Pixel to measure our advertising and understand which pages visitors find useful. It runs only after you accept the cookie banner, and you can decline at any time.
The learning platform itself (family, learner and staff areas) contains no advertising or marketing trackers. No student, family or staff data from inside BUMA is ever shared with advertising partners.
When you book a demo or start a free month, we record which campaign brought you to us (UTM parameters) so we can measure our outreach. Contact details are sent to Meta only in hashed (irreversible) form, and only with your consent.