Written for the person who has to sign it off.
Lerlo holds information about children. This page describes where it lives, who can see it, how it is protected, and how it disappears again. None of the points are plans – they describe the system as it is today.
Where the data lives
Servers in Germany
Lerlo runs at Hetzner in Falkenstein. The database and the uploaded files are in the same place. The browser talks only to lerlo.dk – never directly to the storage.
Emails from the EU
Lerlo sends only service emails – invitations, confirmation codes, password resets. They are sent through a provider in France and never contain information about pupils.
No third parties in the browser
Fonts, scripts and pictures come from lerlo.dk. A Content Security Policy forbids everything else. Visits to the public pages are counted without cookies; the app is not counted at all.
How the data is protected
Encryption field by field
Pupils' first and last names, dates of birth and notes, staff names, lesson titles and notes, seating plan rules, word cloud questions and answers, invitees' names and the log's entries are encrypted in the application (AES-256-GCM) before they are written to the database. The database sees only ciphertext and so can neither search nor sort in them; that happens in the application, one school at a time. The keys are kept outside the database and can be rotated without downtime.
Uploaded files – class photos, pupils' pictures, documents – are encrypted in the application before they are stored, and are fetched only through Lerlo, which checks access every time. Pictures of children have all metadata removed, including a phone's GPS position.
Access by role
A teacher sees the classes the school has put them on, and results only in the subjects they teach the pupil. Notes about a pupil are seen only by the one who wrote them and the school's administrators. Administrators see their whole school. Nobody sees another school – not us either, unless you ask for help. Every access decision goes through one place in the code and is covered by automated tests.
Login and two-factor
All staff log in with email and password and set up two-factor inside Lerlo: an authenticator app or a key (passkey). It can be put off three times; after that it is required. Pupils never log in; in an activity their phone remembers only a random number for a few hours, which cannot be traced back to the child.
Log
Every change to the school's data – classes, pupils, staff, seating plans, teaching, school years, data exports – is in the log with who, when and what was changed, from and to. The log can be read by the school's contact person together with us and is kept for two years. The content of notes is never logged, only that they changed.
The school has a page of its own for what GDPR requires.
- Retention: the school chooses how long pupils who left are kept. After that they are deleted automatically, with results, answers, seats, picture and notes. The log keeps only that the pupil existed.
- Data exports (access requests): everything about a pupil, a class, a member of staff or the whole school is downloaded as a ZIP – data.json for machines, oversigt.html for people, the files as an option. Every export is logged.
- Deletion: if a pupil, a class or the school is deleted, everything that belongs to it disappears at once – the files in the storage too.
- Data minimisation: no personal data in addresses, log files or the browser's storage. A CPR number in an import file is used in the browser to find the date of birth and is never sent.
Sub-processors
The providers Nullbase uses to run Lerlo. The list is the same as in the data processing agreement.
| Provider | Where | What |
|---|---|---|
| Hetzner Online GmbH | Falkenstein, Germany | Hosting of Lerlo and storage of files (encrypted before they are stored) |
| Nullbase chute · Scaleway | Paris, France | Sending service emails – never marketing, never pupil data |
The roles
The school – or the municipality – is the data controller: you decide which information is recorded, and for how long. Nullbase ApS is the data processor: we process the information only to deliver Lerlo and only on your instructions. The data processing agreement describes this, and the list of sub-processors is part of it.
If you have questions this page doesn't answer – a risk assessment, a specific control, a meeting with your DPO – then write to us. We answer with what is actually built, not with what we intend to build.
Want to see Lerlo with your own classes?
We set the school up, show your teachers around and answer the IT questions. No sales pitch, just the product.