In a database managed by the SIS vendor, hosted in the cloud (typically on Amazon Web Services, Microsoft Azure, or Google Cloud). Modern SIS platforms are cloud-native, meaning the district doesn't run any servers to host the data. Legacy platforms sometimes still run on district-managed servers, but this is increasingly rare.

Access is controlled by role. Teachers see students in their classes. Principals see students in their building. Counselors see their caseload. Registrars see everyone. Family members see only their own students. The SIS enforces these boundaries automatically through role‑based access control (RBAC). Audit logs track who accessed what data and when.

They log in in the morning, take attendance (usually within the first 10 minutes of class), and update the gradebook as assessments are completed. Some check family portal messages. During the day, they may look up specific students for context. At the end of the day, they may enter behavior notes or communicate with families. Modern platforms make each of these tasks fast; legacy platforms make them slow.

Through a family portal, typically accessible via web browser and mobile app. Parents receive login credentials from the school and can see their student's grades, attendance, schedule, assignments, and school announcements. They can update their own contact information. They can message teachers. The specific features available depend on what the district enables.

It collects the data required by state reporting requirements throughout the year (demographics, enrollment, attendance, course participation, discipline, program eligibility) and generates the specific submissions your state expects on the schedule your state requires. Modern platforms automate this end-to-end; legacy platforms often require manual export and reformatting.

Cloud-hosted SIS platforms have targeted uptime, typically 99.9% or better. When a platform is down, teachers can't take attendance, families can't check grades, and state reporting is delayed. Reliable vendors have redundancy that limits outages to short windows. Ask about historical uptime during evaluation, not just SLA promises.

Multiple layers: encryption at rest and in transit, role‑based access control, multi-factor authentication for staff, audit logs of data access, regular security testing, third‑party attestations (SOC 2 Type II), and incident response protocols. The district is responsible for the security of user accounts (password management, offboarding); the vendor is responsible for the platform itself.

Alma is a cloud-native, modern SIS. Data is stored securely in the cloud, accessible through web and mobile interfaces, with role‑based access, encryption, and audit logging. Standard integrations (OneRoster, SSO, LMS) work through defined APIs. State reporting is automated for a wide range of states. Ask specifically about the workflows and integrations your district would use.