Welcome to OurNews

OurNews is a public storytelling platform. It gives schools a dedicated place to collect and share the stories of your school, with visibility controls that reduce the risks associated with communicating publicly on platforms like social media.

What we’re setting out to solve

• School newsletters that take many hours to gather content for, write, design, and send.
• School communications that are hard to read and inaccessible (like PDF newsletters).
• Giving schools a tangible way to respond to the changing regulatory, cultural and risk landscape around the sharing of sensitive staff and student information online, especially on social media.
• Giving schools a tool that better equips them to meet the changing ways that parents consume information and connect with their school community.

How it works

• Stories flow into the Hub via a unique email address or a submission link your school shares with contributors.
• The coordinator opens the hub, writes or edits the story, uploads media, and tags it.
• Every story carries two settings: Visibility (Public, shareable by anyone, or Magic Link, opening only for someone who arrives through your school’s own Magic Link) and Access (Anyone, or Email required so photos and names are withheld until a reader signs the visitors’ book). None of these require a parent login.
• The layout and design of each story is automatically curated by the platform in adherence to a set of professionally designed, responsive templates.
• Once a story is ready, it may be published directly to the feed and curated into a collection, such as a newsletter.

What makes OurNews unique

Visibility controls

We designed visibility controls inspired by cybersecurity practices, such as reducing attack surface, to give schools a way to meaningfully reduce the risk of attack or abuse of sensitive information, without having to exclude important community connections from good-news stories (such as future prospective families and grandparents) due to the use of parent logins.

Storytelling culture

As our co-founder, Jacob Shultz from Bolsta Education, regularly speaks about: building a storytelling culture in a school community is an important component of creating belonging, connection and long-term stability. OurNews is built to be the hub of this culture, by centralising story capture, curation and development.

No integrations

We’re acutely aware of ‘platform-fatigue’ in schools. We want to do all we can to reduce the interdependence of platforms, instead seeing ourselves as ‘a layer on top’ of your core ICT infrastructure. So much so that we have a no-integration posture: OurNews should always be able to perform its core function extremely well without relying on integrations.

The Pilot Program

What it is

From September to November 2026, a small group of founding schools across Australia is running OurNews in our Pilot Program. Registration for the pilot is closed. OurNews opens to every school in early 2027, and the waiting list at ournews.school/waiting-list hears first.

Timeline

What founding schools receive

• A working product from day one.
• Your old newsletters uploaded as archives.

Three two-hour workshops with the other founding schools and industry experts:

• Reducing reliance on social media in your comms strategy and enrolment journey
• Keeping your school cyber-safe (with Trent Ray from the Cyber Safety Project)
• Creating a storytelling culture (with YELLOW CAR)

• Direct email support access to the OurNews team.
• No lock-in.

What founding schools are doing

• Using OurNews across the length of the program, internal use recommended to begin with.
• Attending the three workshops.
• Answering a few short questionnaires, and giving a short testimonial at the end.

No founding school is asked to stop its current newsletter or social media, or to decide about switching systems during the pilot.

Our approach to Privacy, Safety & Security

OurNews’s core approach is to reduce attack surface area: what information is held or exposed in the first place, the quantity of sensitive information, how many people can see it, and how many systems it connects to.

Visibility controls

• Visibility: Public or Magic Link. Public can be found and shared by anyone. Magic Link opens only for someone who arrives through your school’s own Magic Link, and doesn’t appear in any listing, search or count to anyone else.
• Access: Anyone or Email required. A story whose Access is Anyone shows its full text and photos to anyone with the address. A story whose Access is Email required shows a reader who hasn’t yet confirmed an email only its title, date and tags; the full story, including photos and names, is shown once the reader signs the visitors’ book with a one-time code. Every entry is recorded in the school’s access log, and a revealed photo carries a visible stamp naming the reader, so sharing is traceable. A photo that a story whose Access is Anyone also shows carries no stamp, because anyone can already see it.
• Magic Link brings Email required with it, so a story is one of three states: Public and Anyone, Public and Email required, or Magic Link and Email required.
• None of these require a parent login or account.

Reducing risk

OurNews aims to reduce your school’s public communications risk from high to low. We use several layers of friction to reduce the risk of both opportunistic misuse and automated, large-scale scraping:

• The Visibility and Access settings themselves (Public or Magic Link; Anyone or Email required), using an email-plus-one-time-code mechanism.
• Withholding happens server-side: content behind Email required is never sent to an anonymous request in the first place.
• The Magic Link, rotated automatically on a schedule and by a coordinator at any time.
• Images are delivered via a URL that only delivers an image if the story’s Visibility and Access settings allow.
• A visible corner stamp on revealed photos, carrying the reader’s own identifier.
• Every reveal recorded in the school’s access log.
• Right-click / save disabled wherever Access is Email required. Left on where Access is Anyone, where sharing is the point.
• Bot and crawler protection: AI crawlers that identify themselves, and AI agents that send a Signature-Agent header, are refused at the door on every school host. Every page and photo on a school’s address carries noindex, noarchive, nosnippet, noai and noimageai instructions in its response headers (story pages carry the noindex in their HTML too) and a text and data mining reservation. Every school host has a robots.txt that disallows every crawler except Google’s, Bing’s and Apple’s search crawlers. Those three get an empty “not found” answer that carries noindex, so they drop any address someone else linked to and never receive a story. Brave’s crawler follows Google’s robots.txt rules without naming itself, so it can read a page, and it honours the page’s noindex. An llms.txt says the pages are not for AI use, and there is no sitemap anywhere, so there is nothing published for a crawler to enumerate from. The instructions work only on crawlers that choose to follow them, and a scraper posing as an ordinary browser is not refused.
• Refusal of requests from regions the school has not allowed. Every school starts open to the whole world and narrows from the Sharing page; the region your own school sits in can never be switched off. A request from a region you have turned off is refused at the door, before any story is read, and the refusal applies to your staff as well as your readers: a coordinator travelling outside your allowed regions is refused too, and the page says so and names your school’s contact address. This is friction, not a boundary: it reads the country from our hosting provider’s edge, lets a request through when no country is given, and does not stop a reader on a VPN.
• Malware scanning on every upload, protecting the platform itself from a malicious file. PDFs are never rendered by OurNews: they’re offered only as a download.
• Encryption, access control and infrastructure

Encryption and data residency

• Content is encrypted at rest and in transit.
• Data is held in the region you choose at signup: Australia, the EU, the UK, the US or Singapore.
• Access control on media. No photo has a raw, public storage link. Every image is served through OurNews’s own access-controlled route, which checks the story’s Visibility and Access settings on every request.
• The content-delivery cache respects these settings: only content whose Access is Anyone is ever cached externally. Email-required content is served fresh on every request and never cached.

Internal and support access

• Our application never runs free-form queries against a school’s content; every read goes through a tenant-scoped access layer. When our team needs to investigate, they use defined, access-controlled tools rather than ad hoc queries against a school’s data.

Underlying infrastructure

• Supabase (database)
• AWS (media storage, email and malware scanning)
• Vercel (application hosting)
• Sentry (error monitoring)
• Cloudflare provides bot protection.

Security certifications

• OurNews is built to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the GDPR.
• We have completed the Safer Technologies 4 Schools (ST4S) Readiness Check, and in October 2026 we submitted OurNews to be considered for full assessment. ST4S decides when the full assessment takes place.
• We maintain a cross-framework control inventory mapped to the SOC 2 trust services criteria, ISO 27001 Annex A and the Essential Eight, and build OurNews to those control expectations. A summary of the control inventory is available on request, per clause 8.2 of our data processing terms.
• Our position, regardless of certification status, is to minimise what we hold: no student database, no parent database, no class lists. The personal information we do hold, published photos and stories, is the same kind of content your school already publishes on its own website, with greatly increased data security measures.

Data processing and handling

• We only store what your school publishes, a small access log of who revealed withheld content and when, and any reports readers send your school about a story.
• We don’t hold parent logins, student ID numbers, enrolment records or biometrics.
• Your school stays the owner and controller of everything it publishes; OurNews acts as the processor. For the small access log, OurNews is the controller, and it’s minimised and time-bounded.
• A takedown removes an image from the live system immediately, because every image is filed against the story it belongs to and is easy to find.
• Every upload is scanned for malware before it becomes visible to anyone, and validated by its file content, not extension.
• PDFs are never rendered by OurNews. They’re offered to a reader only as a download. Staff find a back-catalogue PDF in the hub by its title and issue date.
• Our data processing terms and the services we rely on are published on our trust centre.

Continuity

• You can export everything your school has published at any time, in an open format, without needing to ask us.
• If your school’s account ends, you have 30 days to pull a final export. After that, your content and staff accounts are deleted, and gone from backups 7 days later.
• If we were ever to decide not to continue OurNews, we’ve committed to telling schools in writing, keeping the service running through a wind-down period, and supporting every school to export its content.

Incident response

• If we become aware of a breach affecting your content, we’ll inform you within 72 hours, with what we know at the time, and keep you updated as we learn more.
• We’ll help your school meet its own obligations under your local regulation, such as Australia’s Notifiable Data Breaches scheme.
• We’ll tell you before making any public statement about a breach affecting your content, unless the law requires otherwise.

More questions