Technology and integration
Standards in, standards out. Nothing proprietary on the door.
ClassLock is a policy layer. It reads schedules from the student information system you already run, pushes rules to UL 294 listed door controllers that decide locally, and reports back. For IT directors, facilities engineers and privacy officers, this page is the detail.
Architecture
Central policy. Decision at the door.
Why the decision lives at the door
Each Axis controller stores the credential list, the access rules and its own clock, and "can internally handle all tasks related to door access, even if the network is down." It holds 250,000 credentials and 250,000 events locally. When a badge is presented the controller answers in milliseconds without asking the server. ClassLock syncs rule changes, revocations and lockdown commands to the controllers and subscribes to their event stream.
This is the same architecture used by every major commercial access‑control platform, and it is why the UL 294 listing on the controller is the one that matters: the certified device performs the security function. The server software performs administration.
Network
- Controllers on a dedicated security VLAN, PoE 802.3at, wired only.
- Outbound HTTPS from controllers to the ClassLock server; no inbound ports from the internet.
- Readers on OSDP Secure Channel (AES‑128, supervised wiring), not legacy Wiegand.
- Signed firmware, secure boot and a 5‑year hardware warranty on the controllers.
- On‑premises server by default. District‑controlled cloud sync is optional for multi‑campus dashboards.
Schedule integration
Connects to the scheduling software your district already runs
The three largest district SIS platforms, PowerSchool, Infinite Campus and Skyward, are all certified providers of the 1EdTech OneRoster standard. One standards‑based connector reaches all of them, and Clever and ClassLink re‑expose nearly every other SIS the same way.
What ClassLock reads
- People: students and staff, with role.
- Sections and enrollments: who is in which class.
- Class periods and rooms: OneRoster carries the period slots and the room for every section.
- Terms and calendar.
That is all. No grades, no discipline, no health, no addresses, no Social Security numbers.
Bell times
OneRoster carries period labels, not clock times. Ed‑Fi's Bell Schedule domain does carry start and end times, including late‑start and testing‑day schedules. ClassLock reads them where available and otherwise keeps a per‑school bell table that the office edits in minutes. The schedule source is configured per installation: SIS, ClassLock‑native, or hybrid.
Sync and exceptions
Nightly sync plus on‑demand. Schedule changes, new enrollments and withdrawals flow through automatically. Substitutes, aides, therapists and visitors get time‑boxed credentials issued from the dashboard. Grace periods and passing‑period unlock windows are policy settings, not code.
| Platform | Share of U.S. districts | Rostering path | ClassLock status |
|---|---|---|---|
| PowerSchool SIS | About 23% of identified implementations | OneRoster 1.1/1.2 certified; Ed‑Fi certified; PowerSchool API | Adapter in pilot (MVP) |
| Infinite Campus | About 10%; 3,200+ districts | OneRoster 1.1/1.2 (OAuth 2); Ed‑Fi | Phase 2 adapter |
| Skyward | About 7%; 1,900+ districts | OneRoster certified | Phase 2 adapter |
| Aeries, Synergy, FACTS, Focus, others | Remainder | OneRoster, Clever Secure Sync, ClassLink OneSync, or scheduled CSV | Standards path |
Market share: ListEdTech, The 2025 K‑12 SIS Market. Certifications: 1EdTech, Infinite Campus, Skyward.
Privacy
No cameras. No biometrics. The minimum data, held by the district.
The U.S. Department of Education tells school vendors to "only request or collect the minimum amount of PII that is needed to complete the assigned task." ClassLock's task is to decide whether a credential may open a door, so it holds a name, a role, a credential number and section enrollments. The December 2024 PowerSchool breach exposed Social Security numbers, dates of birth and medical alerts from the SIS. A door system does not need any of those fields, and ClassLock never imports them.
FERPA defines biometric records as fingerprints, retina and iris patterns, voiceprints, DNA, facial characteristics and handwriting. ClassLock collects none of them. New York banned facial recognition in schools in 2023 and requires local review before any other biometric technology; ClassLock is unaffected because it uses none.
Door‑event logs tied to a student are education records. ClassLock holds them under FERPA's school‑official exception, under a district contract, with role‑based access, configurable retention and export on request. The district owns the data.
ED Privacy Technical Assistance Center vendor FAQ · 34 CFR 99.3 · NYSED 2023 determination · PowerSchool incident page
What ClassLock stores
| Person | Name, role, SIS identifier |
| Credential | Card or token number, status, expiry |
| Schedule | Section, room, period, term |
| Events | Door, time, credential, result, reason |
What ClassLock never stores
- Video, audio or images
- Faces, fingerprints or any biometric
- Grades, discipline, health or IEP data
- Addresses, Social Security numbers, dates of birth
- Location outside of door events
Contrast with camera‑based AI. AI gun‑detection systems analyze every camera feed continuously, and the ACLU has documented cameras present at 8 of the 10 deadliest school shootings with no measurable effect on outcomes. ClassLock changes what a door does, not what a camera sees. Compare approaches.
Reliability
Built from parts rated in the millions of cycles
- Grade 1 fail‑secure electric strikes are endurance‑tested to 1,000,000 cycles.
- Schlage ND Grade 1 levers show "nearly zero droop or wobble after 16 million cycles."
- Controllers keep working through network loss with a full local credential cache; events queue and sync when the link returns.
- Power loss: the strike stays locked from the hallway; the lever exits. No battery is required for safety, and PoE switches with UPS keep normal operation through short outages.
Co‑exists with what you have
A layer, not a rip‑and‑replace
- Exterior access control (Genetec, Avigilon, LenelS2, Brivo): stays. ClassLock runs the classroom doors and shares events.
- Panic alert (Centegix, Raptor and others): an alert can trigger a ClassLock lockdown through the API or a dry contact.
- Visitor management: visitor passes can be issued as time‑boxed ClassLock credentials.
- Fire alarm: no interface required for fail‑secure strikes with mechanical egress.
- PA and intercom: unchanged. Late arrivals without a badge can be admitted by intercom and remote unlock, as some districts already do.
API
REST over HTTPS with token authentication and a server‑sent event stream. Endpoints cover doors, lockdown, drills, users and credentials, including register, disable and re‑issue. Auto‑disable rules handle lost badges, repeated denials and expiry.
Talk to our technical team.
Bring your SIS, your network diagram and your door schedule. We will map the integration in one call.