Security & data protection
TUIO holds student, family and payment information for the schools that use it. This page sets out how that information is protected, who can see it, and where it is held.
For what is collected, who it is shared with, and what a family can ask for, see PIPEDA and your school’s data and the full privacy policy.
Last updated 19 August 2026.
Two-factor authentication is mandatory for every user
Every TUIO account is protected by two-factor authentication, and it cannot be turned off. Two-factor authentication means a password on its own is not enough to get in. Whoever is signing in also enters a one-time code.
This applies to every user, parents included. A parent logging in to pay fees goes through the same check as an administrator.
Stolen and re-used passwords are the ordinary way an account is broken into. The one-time code closes that route.
Card and bank details never reach TUIO
When a parent pays, the form they type their card or bank number into belongs to the payment processor and is embedded inside the TUIO page. The number travels from the parent’s browser straight into the processor’s own vault. TUIO never collects it, never transmits it and never stores it.
Nobody at TUIO can see it: not support, not onboarding, not engineering, not the founders. The most anyone at TUIO sees is the last four digits, which the system keeps so a parent can tell one saved payment method from another.
Any organisation that takes card payments completes a PCI DSS self-assessment questionnaire each year. PCI DSS is the card industry’s security standard, and the questionnaire is the paperwork that shows you meet it. The versions differ enormously in effort.
Because card details are entered into the processor’s own form and never touch TUIO, the school qualifies for SAQ-A. That is the shortest version, a couple of dozen questions. A school that took card numbers into systems of its own would be filling in a far longer assessment with scanning and evidence requirements attached.
Who can see a school’s records
Inside a school’s account, what a person can see depends on the role they have been given. A parent sees their own family and nothing else. A staff member sees what their role covers.
Every request and every change is checked before it takes effect. TUIO confirms that it comes from the account that is genuinely signed in, and that the account’s role covers what is being asked for.
Support and onboarding staff at TUIO can see a school’s student and family records. It is how a support question gets answered and how a school’s data gets moved in at the start. Access is limited to the people whose job needs it.
They cannot see card or bank numbers, which are not in TUIO’s systems at all.
When a record is edited, TUIO keeps an audit trail of the change.
Traffic between a browser and TUIO is encrypted
All network traffic between a browser and TUIO’s servers is encrypted, so it cannot be read while it crosses the internet. That covers signing in, every screen a school or a family opens, and every payment.
Where the data is held
TUIO runs on Amazon Web Services, or AWS, the hosting service that a large share of the world’s banking, government and healthcare systems also run on. TUIO’s servers and databases sit in AWS’s Canadian infrastructure.
School and family records are held in Canada.
Files uploaded to TUIO, such as a document attached to a student record, are stored in Canada as well.
The records and the uploaded files are encrypted at rest, which means they are encrypted while they sit in storage. The stored data cannot be read without the keys that unlock it.
TUIO uses other systems to run its own business, such as answering a sales enquiry, sending email and keeping track of our customers. Those are supplied by companies based in the United States, which is why our privacy policy says information may be held in Canada or the United States.
Backups
TUIO backs up its databases every day and keeps recent copies for about a month, so a problem can be rolled back. Backups stay inside the same Canadian environment as the live system.
The backup copies are encrypted in the same way as the live data, and they stay private to TUIO’s own account.
The database is redundant, meaning it runs in two separate Canadian locations. If one goes down, the other can carry the service, and a school’s records stay in Canada either way.
How long records are kept is set out in the privacy policy.
The money goes straight to the school
Families pay the school. TUIO does not hold the funds, pool them, or forward them on later.
Each school is its own merchant of record, the business the bank and the card networks see as the party being paid. That means the school’s own banking relationship, its own settlement, and no exposure to TUIO’s finances.
Contact
Tuio Payments Inc., #1533-2967 Dundas St. W, Toronto, Ontario M6P 1Z2
[email protected]
1 (888) 540-0160
For privacy and PIPEDA questions, see PIPEDA and your school’s data. Requests to see or correct personal information go to [email protected], as set out in the privacy policy.
