Development and Evaluation of TARA: A Privacy-Preserving Zero-Trust Student Information System with Verifiable Auditing for Multi-Campus Educational Data Governance

Schools now hold more digital information about children than at any previous point, yet the arrangements that keep those records safe have not kept pace. Three weaknesses recur: records sit under a single administrator whom everyone else must simply trust, audit logs can be edited by that same administrator without leaving a trace, and access is granted broadly rather than narrowly. This study asked whether a school information system can be built so that its trustworthiness is demonstrated rather than assumed. Using developmental research, it designed, built, evaluated, and deployed TARA, a student information system now operating across three bilingual-school campuses in Thailand serving 288 enrolled learners across 331 active user accounts as of the census date of 18 August 2026. UGNAYAN, a reference architecture for national cross-agency exchange, is presented as a conceptual extension only; it was not built and was not evaluated. TARA enforces access on every request rather than once per login, separates each campus at two independent layers, and writes every security-relevant action into an audit trail whose records are cryptographically linked so that alteration cannot be silent. Evaluation combined performance benchmarking, an isolation-enforcement analysis, and a mapping of the system’s controls onto four international standards. Verification of the audit trail scaled linearly and remained inexpensive, with a one-million-record trail verifying in 6.23 seconds, and every injected alteration was detected and located. Nine of thirteen control objectives were met, two partially, and two remain at the design stage. The study offers school administrators and education agencies a working, standards-grounded reference showing that verifiable student-data governance is achievable on ordinary infrastructure, and it argues that auditability deserves the same standing in educational technology policy as access and usability.