Business Continuity & Recovery Plan

Edminhub is a school management platform owned and operated by Simple Software Development LLC. The platform supports school administration processes such as learner records, teacher information, attendance, subjects, classes, academic records, disciplinary processes, documents, communication, and related operational activities.

This Business Continuity & Recovery Plan describes how Simple Software Development LLC aims to maintain, restore, and support Edminhub in the event of service disruption, system failure, data loss risk, cyber incident, infrastructure outage, or other operational interruption.

The plan is intended to support transparency with schools while preserving practical flexibility for Simple Software Development LLC to respond to incidents based on their severity, cause, technical complexity, third-party dependencies, legal requirements, and information available at the time.

This plan applies to the Edminhub platform and the services operated by Simple Software Development LLC for customer schools. It covers reasonable continuity and recovery arrangements for application availability, infrastructure dependencies, backups, restoration, support communications, incident escalation, and post-incident improvement.

This plan does not cover systems, devices, networks, internet connections, identity providers, third-party tools, integrations, or internal school processes that are selected, managed, configured, or controlled by the school or its users.

The primary objectives of this plan are to:

1. Protect the safety, security, confidentiality, integrity, and availability of information processed through Edminhub where reasonably possible.
2. Restore critical Edminhub service functions following a disruption as quickly as commercially and technically reasonable.
3. Reduce the risk of avoidable data loss through backup, monitoring, and controlled operational practices.
4. Provide clear internal escalation and customer communication during material incidents.
5. Support schools with reasonable information required for their own continuity, governance, legal, parent communication, or regulatory obligations.
6. Review incidents after recovery and improve the platform, procedures, controls, or documentation where practical.

The following service areas are prioritised during recovery. Actual recovery sequence may vary depending on the cause and technical nature of the incident.

The targets below are planning targets only. They are not service guarantees, warranties, penalty commitments, or automatic service credit commitments unless expressly included in the applicable SaaS Subscription Agreement or written service order.

Edminhub performs daily backups with a retention period of 7 days.

Point-in-time backups may be available where a school makes a special written arrangement with Edminhub / Simple Software Development LLC.

Backups are intended for disaster recovery and operational resilience. They are not intended to replace the school's own statutory recordkeeping, data governance, audit, compliance, independent export, or internal continuity obligations.

When a material disruption is identified, Simple Software Development LLC will follow a structured response process where practical:

1. 1
   Detection and logging: Identify the issue through monitoring, customer report, support request, system alert, or internal review.
2. 2
   Initial assessment: Determine severity, affected services, affected schools, data risk, security implications, and whether third-party providers are involved.
3. 3
   Containment: Take reasonable steps to limit impact, which may include disabling affected functions, restricting access, isolating systems, or pausing integrations.
4. 4
   Recovery planning: Determine the safest and most practical restoration path, including whether backup restoration, provider escalation, code rollback, configuration correction, or customer action is required.
5. 5
   Service restoration: Restore critical services first, then non-critical functions, subject to validation and security checks.
6. 6
   Customer communication: Notify affected schools where appropriate and provide reasonable updates based on available facts.
7. 7
   Post-incident review: Review root cause, lessons learned, control improvements, customer follow-up requirements, and documentation updates.

One individual may perform more than one role depending on the size, severity, and timing of the incident. Role allocation may change as the company grows.

Business continuity is a shared responsibility. Schools remain responsible for continuity measures within their own environment and for school-level operational decisions.

Simple Software Development LLC will communicate with affected schools where appropriate during material incidents. Communications may include the known issue, affected service areas, workarounds where available, expected next update where practical, and any actions required from the school.

Communications will be based on facts reasonably known at the time and may be updated as investigation continues. Early communications may be incomplete because the priority may be containment, evidence preservation, security validation, or service restoration.

If a continuity event involves suspected or confirmed unauthorised access, data exposure, malware, ransomware, exploited vulnerability, credential compromise, or other security risk, the Edminhub Incident Response Procedure will apply.

In such cases, Simple Software Development LLC may temporarily suspend access, disable features, rotate credentials, restrict administrative functions, or take other containment measures if reasonably required to protect the platform, affected schools, data subjects, or the wider service environment.

Incident communications, cooperation, investigation, recovery, or remedial actions do not constitute an admission of liability, fault, negligence, unlawful conduct, or breach by Simple Software Development LLC, its directors, officers, members, employees, agents, contractors, or affiliates.

Edminhub may rely on reputable third-party providers for hosting, infrastructure, storage, database services, email delivery, monitoring, backups, support, security, analytics, and related operational services.

Disruptions at third-party providers may affect the availability or performance of Edminhub. Simple Software Development LLC will take reasonable steps to monitor, escalate, work around, or recover from third-party disruptions where commercially and technically practical. However, Simple Software Development LLC cannot guarantee the performance, availability, security, or recovery timelines of third-party providers outside its reasonable control.

Schools should maintain practical manual workarounds for short-term disruption to digital systems. Recommended school-level workarounds include:

• Maintain emergency contact lists for staff, parents, guardians, and key school administrators.
• Keep a local process for capturing attendance when the platform or internet connection is unavailable.
• Maintain manual or offline templates for urgent disciplinary notes, incident reports, or academic observations.
• Export important reports or records periodically where required by the school's own compliance or operational needs.
• Define who at the school may contact Edminhub support during urgent incidents.
• Ensure school staff know how to operate during local power outages, internet failures, or device failures.

Simple Software Development LLC may review and improve its continuity and recovery practices over time based on platform maturity, customer requirements, operational experience, incident lessons, risk assessments, and commercially reasonable security improvements.

This plan is intended to describe continuity and recovery practices. It does not create a warranty, guarantee, service credit, penalty obligation, insurance obligation, fiduciary duty, professional advisory relationship, or expanded legal duty beyond what is expressly agreed in the applicable written agreement with the school.

To the fullest extent permitted by applicable law, Simple Software Development LLC, its directors, officers, members, employees, agents, contractors, and affiliates shall not be liable for indirect, incidental, special, punitive, exemplary, or consequential loss arising from any disruption, outage, data loss, restoration delay, third-party failure, customer-side failure, cyber event, force majeure event, or use of Edminhub.

Nothing in this plan is intended to expand Simple Software Development LLC's liability beyond the limits agreed in the applicable SaaS Subscription Agreement, Data Processing Agreement, Privacy Policy, or other written contract with the school.

Simple Software Development LLC will not be responsible for failure or delay in performance caused by events outside its reasonable control. Such events may include natural disasters, power grid failure, telecommunications failure, internet outage, labour dispute, war, terrorism, civil unrest, pandemic, government action, cyberattack, ransomware, denial-of-service attack, failure of third-party providers, or other events beyond reasonable control.

During such events, Simple Software Development LLC will use commercially reasonable efforts to reduce impact and restore affected services where practical.

This Business Continuity & Recovery Plan should be read together with the following Edminhub documents where applicable:

• Edminhub SaaS Subscription Agreement.
• Edminhub Security and Privacy Statement.
• Edminhub Data Processing Agreement.
• Edminhub Child Data Protection Statement.
• Edminhub Security Overview.
• Edminhub Incident Response Procedure.
• Edminhub Data Retention Policy.
• Edminhub Access Control Matrix.
• Edminhub Privacy Policy.

If there is a conflict between this plan and a signed agreement, the signed agreement will take precedence to the extent of the conflict, unless otherwise agreed in writing.

Questions about Edminhub business continuity, recovery, security, or data protection may be directed to: