For the person who owns the RFP, the DPA, the SIS sync and the 4pm parent escalation
You did not ask for another vendor evaluation. It arrived attached to a renewal number, or to a superintendent forwarding a demo request. This page is written to be read in the fifteen minutes you have between tickets, and it puts the architecture and the gaps in front of the marketing.
| Question you will be asked | Kastr's literal answer |
|---|---|
| How is one district's data isolated from another's? | Postgres row-level security. Every request runs inside a transaction as a non-owner, DML-only role (SET LOCAL ROLE kastr_app), so table ownership cannot silently bypass the policy. |
| What happens if the tenant context is missing? | It fails closed. With no app.current_org_id set, policies evaluate against NULL and return zero rows — not all rows. |
| Is isolation tested, or asserted? | A cross-tenant leakage suite runs in CI against real Postgres 16, including an owner-bypass regression check. |
| Can a school see another school's data? | Isolation is hierarchy-aware: a district sees itself and its child schools, never a sibling district. |
| Can the message log be altered after the fact? | Per-org SHA-256 hash chain, hash = sha256(prevHash ‖ canonical(event)), serialised under an advisory transaction lock. Append-only at two independent layers: REVOKE UPDATE, DELETE and INSERT/SELECT-only RLS policies with no UPDATE or DELETE policy at all. |
| What is the authentication model? | Magic link only. 32 random bytes, 15-minute TTL, single-use, atomic consume that defeats prefetch replay, same-device binding via a hashed-token cookie compared with timingSafeEqual, and no account enumeration — a token is issued whether or not the address exists. |
| What do you store about a session? | The session IP is stored hashed and truncated, never raw. |
| How are API credentials held? | SHA-256 hashed at rest; the plaintext key is displayed exactly once at creation. |
| What stops a bad roster file wiping our families? | The sync aborts with aborted_guardrail if it would withdraw more than 50% of active records, and records the run as aborted rather than applying it. |
| Can a connector config contain a raw secret? | No. Configs hard-reject literal credentials matching sk_, whsec_, AKIA, AIza, ghp_, xox[bp]- and PEM headers. You supply reference pointers instead. |
The week this page is written for
The published version of a technology director's job is strategy. The real distribution, in every district we have talked to, is roughly 80% reactive, 15% maintenance and 5% strategic — and the strategic 5% is what gets cancelled first when a building loses its switch stack on a Tuesday.
Meanwhile you own, in practice and regardless of the org chart:
- The RFP, including the parts about communications that the communications director wrote and cannot defend technically.
- The data privacy agreement, the sub-processor list, and the question from a board member about where the data physically sits.
- The E-rate filing calendar, which is not a communications platform's problem but is definitely yours in the same weeks.
- The SIS sync, which nobody thanks you for until it breaks and 400 families stop getting attendance calls.
- The parent escalation that starts in the front office, passes through a principal, and arrives at your team at four o'clock as "the texts are broken".
A communications platform touches four of those five. That is why this is your evaluation whether or not it was assigned to you, and why the questions that matter are architectural rather than featural.
What we have not built — the part other vendors leave for the demo
Kastr is pre-launch in August 2026. We have no customers, no SOC 2 audit and no reference calls to offer you. If proven scale carries real weight in your evaluation — and for most districts it should — that is a legitimate reason to choose an incumbent, and we would rather you learn it here than in week six of a procurement.
The specific gaps, stated as they are rather than as roadmap language:
- No SSO of any kind. No SAML, no OIDC, no Google or ClassLink sign-in, no MFA. Magic link is the only authentication path that exists. If you are standardised on Entra ID and require federated identity for staff tools, we fail your requirement today.
- No native SIS connectors. There is no PowerSchool, Infinite Campus, Skyward, Aeries or Synergy integration. Roster data reaches Kastr because something you control POSTs it to
/api/v1/roster/sync. That is a real integration path with a documented contract, and it is also more work for your team than a checkbox. - Audience targeting is narrower than the UI implies. Only "specific people" and "everyone" actually resolve. Grade, school, class, language and route presets do not filter as you would expect; the API rejects them with a 400. Do not plan a bus-route notification workflow around this product yet.
- Auto-notices do not fire. The rule configuration screen exists. No engine reads those rules. It is roadmap, and it is on the roadmap page rather than in the feature list for that reason.
- Send-time suppression is not enforced. Audience resolution does not yet consult enrolment status or messaging-suppressed flags, so a withdrawn student's guardians are not automatically dropped from a send. This is the defect we are least comfortable with and the one we are fixing first.
- Retention is documented, not enforced. Per-record-class retention defaults are published in settings. No purge job runs against them. Treat that table as a policy statement, not a control.
- Export is a contract right, not a button. Clause §7.1 gives you machine-readable export of everything, at any time, without fee or notice. There is no self-serve export route in the product; today we run it for you on request. The clause is enforceable; the button does not exist.
- API scope enforcement is partial. Scopes are checked for send and SCIM operations. A non-revoked key can read org data regardless of the scope you granted it. Do not present scope-based access control to your security team as a Kastr control.
- Rate limiting is per-process and in-memory. Correct
X-RateLimit-*andRetry-Afterheaders, four tiers, but the counters reset on restart and do not coordinate across instances. - SCIM is beta.
userName eqis the only supported filter,totalResultsreturns the page size, and there is no DELETE, no /Groups and no /ServiceProviderConfig. It will not survive a strict IdP's pagination. - No attachments, no photo or video sharing, no push notifications. Teachers use the first two daily elsewhere.
- 10DLC registration is not complete. Brand and campaign registration carries a two-to-six week lead time before real SMS moves at volume. Any deployment plan has to hold that in the critical path.
The integration surface, which is the part nobody else ships
Every named competitor in K-12 communications treats integration as a partner programme you apply to. Kastr publishes the interface instead:
- 28 REST endpoints, org-scoped and RLS-enforced, so the API cannot see more than the session that called it.
- Signed outbound webhooks —
X-Kastr-Signature: sha256=<hmac>computed over"${timestamp}.${rawBody}", with a DNS-resolving SSRF guard that rejects loopback, RFC1918 and link-local targets after resolution rather than by string matching, retry backoff at 1, 2, 5, 15, 60 and 360 minutes, and automatic endpoint disable after ten consecutive failures. - An MIT-licensed CLI and MCP server — 16 commands and 19 MCP tools, in a public repository, usable without our permission. If you want to script a bulk operation at eleven o'clock on a Sunday, you can, and you can read the code that does it first.
The practical test of a vendor's integration posture is whether their tooling still works when the relationship ends. Ours is under a licence that survives us.
Price, and the three-year number
$3.50 per student per year under 5,000 students, $3.25 from 5,000 to 14,999, $3.00 at 15,000 and above. One tier. Every feature at every size. No implementation fee, no per-message fee, no add-on modules.
Clause §3.2 fixes that rate for 36 months. From year four, the annual increase is capped at the lesser of CPI-U or 5%, written into the agreement as a number rather than a commitment to be reasonable. A 4,200-student district pays $14,700 a year, $44,100 over the locked term, and the worst legal case in year four is $15,435.
Two other clauses matter to the person who has to explain them: §11.2 gives you a 90-day exit with export and prorated refund if we are acquired or materially change data terms, and §9.4 forbids us from ever marketing to, selling to, or monetising your families.
Questions people actually ask
Does Kastr support SAML, OIDC or SSO?
No. There is no SAML, OIDC, OAuth sign-in, password login or MFA anywhere in the product. Magic link is the only authentication mechanism: 32 random bytes, 15-minute TTL, single-use, bound to the requesting device. If federated staff identity is a hard requirement in your environment, we do not meet it today.
How is one district's data isolated from another district's data?
Postgres row-level security, enforced inside every transaction under a non-owner role that holds only DML rights, so table ownership cannot bypass the policy. Isolation is hierarchy-aware, so a district sees its own schools and nothing else, and it fails closed — with no org context set, queries return zero rows. A cross-tenant leakage suite runs in CI against real Postgres 16.
Can I prove to a board or an auditor that a message log has not been altered?
Yes. Every audit event is chained: each row stores a SHA-256 hash over the previous hash and the canonical form of the event, serialised under an advisory lock so the chain stays correct under concurrency. The table is append-only at two independent layers — UPDATE and DELETE are revoked at the role level, and the RLS policy set contains no UPDATE or DELETE policy. A single altered or removed row breaks the chain verifiably.
Does Kastr have a native PowerSchool, Infinite Campus, Aeries or Skyward connector?
No. None of those exist. Roster data arrives because a job you control POSTs it to /api/v1/roster/sync, or because your rostering intermediary is configured to do so. The sync applies a diff with SHA-256 payload hashing and aborts if it would withdraw more than half of active records, but the fetch half is your side of the line today.
Is Kastr SOC 2 certified?
No. We are pre-launch and have not been audited. The architecture described on this page is real and verifiable in code; the third-party attestation is not there yet, and any page on our site that implies otherwise is a bug we want reported.
What exactly do we get out if we leave, and how fast?
Clause §7.1 is a contract right to export everything you have put in, machine-readable, at any time, without notice and without fee. Being precise about the mechanism: there is no self-serve export screen in the product today, so we run it for you on request. The right is enforceable regardless of whether we build the button.
What happens to our price at renewal?
Nothing, for 36 months — §3.2 fixes the per-student rate for the initial term, and anything we ship during it is included. From year four the annual increase is capped at the lesser of CPI-U or 5%. That cap is in the agreement you sign, not in a sales email.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.