Standard operating plan · Records preservation
How IBS keeps records safe — for the long term.
A written plan for pupil records, media assets, cultural archive, financial records and historical records. Reviewed every August by the Head Teacher and Bursar.
🎯 Objectives
- No single point of failure. Every record exists in at least 3 places, on at least 2 media types, with at least 1 copy off-site (the 3-2-1 backup rule).
- Write-Once, Read-Many. Financial, safeguarding and cultural masters can be viewed by many, but altered by no-one — even us.
- Ghana Data Protection Act (Act 843) compliant. Personal data of pupils and staff is retained only as long as needed, and destroyed securely thereafter.
- Recoverable in a day. Any deleted file, from any point in the last 12 months, must be recoverable within 24 hours.
🗂 Storage layers
We use four layers. Every record lives in at least two of them.
Layer 1
Live working copy
Files staff work with day-to-day — SchoolOS state, OneDrive, Google Workspace. Fast, editable.
Layer 2
Warm backup
Nightly encrypted snapshot to Cloudflare R2 (S3-compatible object storage). Versioned 90 days.
Layer 3
WORM archive
Monthly frozen snapshot to Cloudflare R2 Object Lock (Write-Once-Read-Many). Nothing here can be altered, even by the Proprietor. Retained per policy.
Layer 4
Off-site cold
Quarterly encrypted USB drive (LUKS or BitLocker) held in the Board Chair's fireproof safe. Rotated 4 drives (12 months).
📚 Category-by-category
| Record type | Retention | Storage layers | Legal basis |
|---|---|---|---|
| Pupil records (admission, reports, safeguarding) | 7 years after leaving IBS | 1 · 2 · 3 | Ghana Data Protection Act (Act 843); GES retention guidance |
| Safeguarding files | Life of pupil (paper) + 25 years | 1 · 3 (WORM only) | Ghana Children's Act, 1998 (Act 560) |
| Staff records (contracts, appraisals) | 7 years after leaving | 1 · 2 · 3 | Labour Act, 2003 (Act 651) |
| Financial records (fees, payroll, bank rec, invoices) | 6 years minimum | 1 · 2 · 3 · 4 | GRA / Companies Act, 2019 (Act 992) |
| Board minutes & PTA minutes | Permanent | 1 · 3 · 4 | Governance / historical |
| Cultural archive (poems, anthem, songs, video) | Permanent | 1 · 2 · 3 · 4 | Historical / institutional |
| Media assets (photos, videos, press) | 10 years then review | 1 · 2 · 3 | Consent-based; deleted on request |
| Alumni directory | While consent stands | 1 · 2 | Consent (Data Protection Act) |
| Applications (rejected) | 2 years then secure destroy | 1 only | Data minimisation |
| ID card photos | 2 years after leaving | 1 · 3 | Consent (with parent for pupils) |
🔐 Security controls
- Encryption at rest. All layers use AES-256. Off-site USB drives are LUKS-2 or BitLocker with recovery key held by two adults.
- Encryption in transit. TLS 1.3 everywhere. HSTS with preload on ibs-edu.org. Verified live.
- Access control. RACI-based in SchoolOS. Two-adult approval on financial records ≥ GHS 5,000 and any deletion of a safeguarding record.
- Audit trail. Every write and every download is logged (SchoolOS hash-chained audit log). Log cannot be edited.
- Physical security. Off-site USB drives are in a fireproof safe with two-key access (Board Chair + Head Teacher).
- Break-glass. Written recovery procedure. Tested twice a year — one restore drill in October, one in March.
♻️ Backup schedule & testing
| What | How often | Owner | Test cadence |
|---|---|---|---|
| SchoolOS state export | Nightly (auto) | ICT Coordinator | Monthly random restore |
| Financial records | Weekly + monthly close | Bursar | Quarterly test restore |
| Cultural archive masters | On upload + monthly re-check | Media Team lead | Bi-annual read-back |
| WORM (Object Lock) snapshot | Monthly · 25th of each month | ICT Coordinator | Annual audit by external auditor |
| Off-site USB rotation | Quarterly (Mar, Jun, Sep, Dec) | Bursar + Head | On rotation, verify read integrity |
| Disaster-recovery drill | Twice yearly | Head Teacher | Full end-to-end restore |
🎼 Long-term cultural preservation
Poems, anthem, songs and video are the emotional legacy of IBS. They get special treatment.
- Original master files uncompressed WAV (audio) + ProRes / H.264 high-bitrate MP4 (video) archived in R2 Object Lock.
- Streaming copies for the website — MP3 128 kbps, MP4 H.264 720 p.
- Text copies of every poem, anthem, prayer — plain-text UTF-8, plus a print-ready PDF, stored on all four layers.
- Provenance record — every work has author, date, occasion, and rights statement filed with it. Never separated.
- Print backup — one bound hardback edition of every poem & anthem update prepared every three years and kept in the school archive room.
🚨 What to do when a file is lost
- Report to ICT Coordinator within 24 hours (email ict@ibs-edu.org).
- ICT checks Layer 2 warm backup — usually resolved within an hour.
- If not there, ICT + Bursar restore from Layer 3 WORM snapshot.
- Only if all layers fail: escalate to Head Teacher; use Layer 4 off-site USB.
- Log the incident in the SchoolOS Risk Register; review at next SLT meeting.
💡 Recommended for the next 12 months
- Move the SchoolOS backend from browser localStorage to Cloudflare D1 (SQLite) + R2 — durable, versioned, MFA-gated.
- Enable Cloudflare Access in front of /schoolos (magic-link email or Google Workspace SSO) for MFA-grade staff login.
- Register the cultural archive audio/video in a public national repository (e.g. Ghana Broadcasting Corporation Educational Archive) so IBS work outlives us.
- Enroll IBS domain in Ghana .gh registrar auto-renew and set a 10-year renewal calendar reminder.
- Print the Cultural Archive Volume I (2018–2026) — 200 hardback copies as a physical legacy.