Where your data lives
Dance Master Pro runs on servers in a data centre in Frankfurt, Germany. The application, its databases and its backups do not leave the European Union, and our support team’s remote access likewise takes place only from within the EU.
Your documents stay with you, not with us
This is the most important decision in the architecture of this software, and it sets us apart from most comparable providers.
Invoices, medical certificates, photos and videos are not stored on our servers. You connect your own cloud storage — Google Drive, Dropbox or Microsoft OneDrive — and the files go straight there. You keep access to them even if you one day stop using Dance Master Pro.
What stays on our systems is only what is needed to find a document again: invoice number and amount, a certificate’s expiry date, a gallery’s title. Photo and video galleries add small preview images, held in a directory outside the web server and served only after a permission check.
When a family views a photo or a video in the portal, we generate a fresh, short-lived link from your storage provider for that request, or stream the file through our server. We never set “anyone with the link” sharing on your files. Your storage stays exactly as private as you configured it.
A separate database for every school
Every school has its own separate database. There is no shared table holding several schools’ pupils side by side, kept apart by a filter. Mixing them up is not unlikely — it is structurally impossible.
Encrypted connections
All traffic between you and the application is TLS encrypted; unencrypted requests are redirected.
Who can see what
Access is through personal accounts, never shared logins. Four roles — administration, office, teacher and family — each see only what their work requires. Areas not enabled for a role are blocked server-side, not merely hidden in the interface.
In the family portal a parent sees only their own children’s data, and every request for an item is checked against permissions even when someone types an address directly.
Whole functional areas can be switched off. If your school does not manage medical certificates, that data is never collected and never displayed.
Backups and recovery
The entire server, including all databases, is backed up automatically every day. Backups stay in the same Frankfurt data centre and do not leave the European Union.
What happens when you leave
Access is blocked and the data stays in a blocked state for 30 days, so an accidental cancellation can be reversed and a missing export completed. After that the data is returned or permanently deleted — you choose which.
Important for German schools: invoices and accounting records must be retained for several years under § 147 AO and § 257 HGB. Export them before access is blocked. We remind you beforehand and provide the export functions, but we are not permitted to hold the data for you.
Documents in your own cloud storage are unaffected by any of this. They remain with you.
What we say openly
We are not ISO/IEC 27001 certified. Our data centre and infrastructure provider is, and we make that evidence available on request. The complete, binding list of measures is in our technical and organisational measures, including the items we have yet to implement and the date each is due. We think showing that is better than claiming a list with no gaps in it.
What we take on, and what stays with you
Running, securing and maintaining the platform is our job: server operation, encryption, keeping schools separate from one another, backups, security updates, monitoring, and notifying you of any incident within 48 hours. That is what we answer for, and what we are liable to you for.
What stays with you is what only you can know: which members of staff have access, and in which role. When someone leaves your school, you revoke their access — no provider in the world has that information. We give you the tools for it and get in touch when something looks wrong to us.
Reporting a security issue
security@dancemasterpro.com — external reports welcome. Vulnerability reports are taken seriously and answered.