Tawaasal 2.6: safer by default

September 30, 2026 · Abdulkareem H. Ali

Most of Tawaasal 2.6 is work you will never see on a screen. We went back over the security of the whole platform, end to end, and fixed everything we found. We also turned many of those checks into rules the code has to pass before it can ship, so a mistake of the same kind stops at our door rather than reaching a school.

Around that sit changes you will notice: safeguarding drafts that stay private, grades that follow your school's own scale, and documents that print properly in every language. New versions of the iOS and Android apps are out alongside it.

Security, reviewed again

A school trusts us with children's records, families' payments and staff accounts. Here is what that looks like in 2.6:

Payments are marked paid only when the payment provider confirms them, with a valid signature, for the right amount and in the right currency. A confirmed payment cannot be undone or counted twice.
Nobody can give themselves more power than the role they were given. Making someone a school admin, or removing it, asks for your own password (or your authenticator code if you sign in with single sign-on), and it is recorded.
Each school sees only its own records, everywhere: people, events, bookings, promotions and finance included. A reference to another school's record is treated as if it does not exist.
Teachers see and grade the classes they teach. A school can give a head of department read-only access to every class, which never allows changing anything.
Sensitive records reach only the people entitled to them: the security log, homework feedback, a pupil's academic history, and the files people upload.
An account stays with its owner. Changing a password signs it out everywhere else, sign-in and verification codes are stored only in a form that would be useless if someone read it from the database, and platform accounts must use an authenticator app.
The database admin screens do not exist on the live service. They are switched on only for local development.

Safeguarding drafts that stay private

Anyone who can raise a safeguarding concern can now save it part-way and come back to it, on the web and in the phone app. Your unsent drafts are listed when you open the form again, and only you can see them. That includes the safeguarding lead, because an unfinished note is not yet something the school has received.

Once you submit, the concern belongs to the safeguarding team alone. If the team decides you need to know how things stand, it can share a summary: the category, status and dates, never the notes or the outcome.

Grades by your school's own scale

Letter grades on a guardian's page, pass rates and grade distributions in reports now all follow the grading scale your school has set, not a fixed A to F. A guardian's page and their child's own page now quote the same average.

One thing to expect: pass rates in reports may change, including past ones, because they are now measured against your scale. On our demo school, a report that read 100% now reads 81.3%. The new figure is the one your school's own grades screen always implied.

Documents in every language

Report cards, invoices, receipts, finance reports and safeguarding exports now print correctly in all eleven languages Tawaasal speaks, including Arabic, Persian, Urdu, Hindi and Japanese. Each document comes out in the language of the person downloading it, reads in the right direction, and keeps every word a school typed into it.

And smaller things that add up

Teachers have an Attendance Reports tab alongside Mark Attendance.
Guardians can open their child's full attendance history from the sidebar.
A head of department can read every class's report cards.
Parents see their child's emergency contacts even when the school has switched off guardian access to wellbeing details.
New schools start with their safeguarding team types and roles already set up, in the school's own language.
Imported staff receive an invitation that lasts seven days, instead of a reset link that expired before they opened it.
Every page has a small question mark that opens its guide, for your role and in your language.

Most of 2.6 is the kind of work that only shows when it is missing. That is rather the point. If something here raises a question for your school, [ask us](/en/contact).