Security and data protection

Your institution's data stays separate, minimal and yours.

A timetable needs names, enrolments and rooms. Nothing more is collected, nothing is shared between institutions, and no personal data leaves the platform for optimisation.

At a glance

  • A dedicated database per customer

    Isolation by architecture, not by a filter in a shared database.

  • Only the data a timetable needs

    No grades, finance, health or disability records.

  • No personal data sent to the engine

    The optimiser works on sessions, rules and rooms only.

  • A permanent record of what was published

    Published timetables are versioned, never edited in place.

In detail.

How is our data separated from other customers?

Each customer runs on its own database. No table is shared between institutions, so one institution's records cannot appear in another's queries. Each deployment is configured through its environment rather than through customer-specific code.

What personal data does TimelyNodes hold?

For staff and students: name, institutional email address and identifier. For students, also programme, year of study and module enrolments. Nothing else from the student record is required, and we do not ask for it.

What does the optimisation engine receive?

Sessions, rules and rooms: module codes, durations, capacities and building names. It never receives a person's name, email address or identifier. Students are represented only as the fact that certain sessions must not overlap.

Can a published timetable be altered after the fact?

No. A change publishes a new version and the previous one is retained, giving a complete record of what students and staff were told, and when.

How do we get our data out?

Published timetables are available through a documented API and as calendar feeds. Rooms, modules and rules export as a plain text file.

Will you complete our security questionnaire?

Yes. We complete your institution's own questionnaire as part of every pilot, with specific answers for your reviewers.

Begin your review early.

Data-protection review is often the longest step in procurement. Send us your questionnaire at the start of a pilot, and the answers will be ready when your committee needs them.