For charter networks: shared operations, separate accountability, one communication system
A charter management organisation has the operating model of a district and the accountability model of several independent schools at once. The awkward part is that most communications platforms model exactly one of those.
| Scope | Reads | Sends to | Enforcement |
|---|---|---|---|
| CMO / network office | Every campus in the network | Any campus, or all of them | Parent org in a hierarchy-aware row-level security policy |
| Campus director | Their campus only | Their campus families | Child-org context; a campus account cannot resolve another campus's rows at all |
| Shared back-office staff person | The campuses their roles cover | Same | One person record with effective-dated roles per campus — not duplicate logins |
| Teacher at two campuses | Their own students, at both | Those students' guardians | Enrolment-derived, across both role rows |
| Family with children at two campuses | Their own children | — | One guardian identity, two student links; not two accounts |
| Parent volunteer running a campus group | Their group | Their group's members | Group governance with zero network-console access |
| Another network entirely | Nothing | Nothing | Separate org tree; policies fail closed with no org context |
Why one person, three campuses is the real test
The staffing pattern that breaks most platforms is not the org chart. It is the operations manager who covers three campuses, the dean who moved from one campus to another in January, and the teacher who is also a parent at a fourth.
The common workaround is duplicate accounts — one login per campus per person — and it fails in three predictable ways: the person misses messages sent to the account they were not logged into, offboarding leaves an account behind, and the audit trail fragments across identities so nobody can answer "what did she send, from anywhere, last spring".
Kastr models one person record carrying multiple effective-dated role rows. The dean who moved campuses in January has one identity with a role that ended and a role that began, both dated. A parent who is also a teacher is genuinely both, on one record, without a second account. In our own competitor matrix this row reads nobody, which surprised us when we compiled it and has held up since.
What an authorizer asks for, and where the record is
Charter renewal reviews increasingly ask about family notification: whether required notices went out, to whom, in what language, and when. The weak answer is a screenshot of a sent-items list. The stronger answer is a log the platform cannot rewrite.
Every send, audience resolution and moderation action in Kastr writes an event into a per-organisation SHA-256 hash chain, where each row hashes the previous hash together with the canonical form of the event. The table is append-only at two independent layers: UPDATE and DELETE are revoked at the database-role level, and the row-level security policy set contains no UPDATE or DELETE policy at all. A single altered or deleted row breaks the chain in a way that is detectable rather than deniable — including if we altered it.
Two honest limits for an authorizer conversation. The chain proves an event occurred as recorded; it does not prove a family read the message, and no system can. And there is no self-serve export button today — §7.1 makes the export a contractual right and we produce it on request.
Pricing across a network
Enrolment is counted across the network, not per campus, which matters because the bands are steep at the boundaries. A network of six campuses totalling 5,400 students prices at $3.25 rather than the $3.50 each campus would pay independently: $17,550 a year, $52,650 across the locked 36 months. Split into six separate contracts at 900 students each, the same network would pay $18,900 a year and get six renewal conversations instead of one.
Growth inside the term does not re-price. Enrolment is set at signature and §3.2 fixes the rate for 36 months, so opening a seventh campus mid-term does not trigger a true-up invoice. For a network in expansion that is worth more than a marginal per-student difference, because it makes the line item forecastable across a growth plan.
The clause that matters for a network board. §11.2: if Kastr is acquired or materially changes its data terms, you may terminate within 90 days with a full export and a prorated refund, no penalty. Networks are more exposed to vendor consolidation than districts because they buy fewer, bigger platforms — and this category has been consolidating for three years.
Where a network will hit our limits
- No campus-level branding controls. Messages carry the sending organisation's identity, but there is no per-campus theming or template library scoped to a campus.
- No SSO. Magic link only. Networks tend to run tighter identity management than districts, so this is a more common blocker here.
- No approval workflow. If your network requires CMO sign-off before a campus sends, that is policy and audit, not software.
- No grade or campus-preset targeting. "Specific people" and "everyone" are the audiences that resolve. Campus scoping works because a campus account is scoped; picking "all sixth grade across the network" does not.
- No attachments and no push notifications. Both are frequently expected by campus staff.
- Pre-launch. No customers, no SOC 2, no references.
Questions people actually ask
Can a campus director send without CMO approval, and can the CMO see it?
Yes to both, if you configure it that way. A campus-scoped account can send to its own families and cannot resolve another campus's rows; the network office sits above every campus in the hierarchy and reads all of them. There is no approval workflow, so "campus may send, CMO must approve first" is enforced by policy and the audit log rather than by a hold state.
Can one staff member work across three campuses on one login?
Yes. One person record carries multiple effective-dated role rows, so a shared operations manager holds a role at each campus without duplicate accounts. When someone moves campuses, the old role ends and the new one begins with dates, and their history stays on one identity rather than fragmenting across logins.
Is enrolment counted network-wide for pricing?
Yes. A six-campus network of 5,400 students prices at the 5,000-plus band of $3.25 per student, not at each campus's individual band. That is $17,550 a year and $52,650 across the locked 36-month term, against $18,900 a year if the same campuses contracted separately.
Can we prove notification for an authorizer review?
You can prove the send. Every send and audience resolution writes into a per-organisation SHA-256 hash chain that is append-only at both the database-role and policy level, so an altered or missing record is detectable rather than deniable. What no platform can prove is that a family read the message, and an authorizer response should not claim otherwise.
What happens when a campus leaves the network?
Commercially, enrolment is fixed at signature for the locked term, so a departing campus does not trigger a mid-term re-price in either direction. Operationally, moving one campus's data out is an export under §7.1, which is a contractual right we fulfil on request rather than a self-serve function today. Plan the timing with us rather than assuming a button.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.