The entire Jamf School database is encrypted at rest, including all logs, backups, and snapshots.
Passwords for Jamf School administrator accounts are hashed using the bcrypt password-based key derivation function. Certificate passwords are also encrypted and stored to use when a user authenticates.
FileVault individual recovery keys are encrypted using a standard AES-256 algorithm with a unique key for each Jamf School instance that is stored in the database.