How we protect a university’s data

What follows describes how the product works today. Where something is not built yet, it is listed at the end.

Data location
Data is hosted in India, on AWS in Mumbai, and does not leave the country.
Universities are kept apart
Every record belongs to one university, and every query is scoped to it. A user at one university cannot reach another’s data.
Our team cannot browse your data
The console our staff use to manage universities has no access to student, staff or finance records, and what they do there is logged.
Sign-in and sessions
Passwords are stored as argon2 hashes. Access tokens last 60 minutes, sessions renew through rotating refresh tokens, cookies are HTTP-only and secure, and repeated failed sign-ins lock the account for 15 minutes.
Access by role
Permissions are granular and assigned by role. Each role sees only what it needs, and a change to someone’s roles takes effect straight away.
Sensitive fields are encrypted
Aadhaar and PAN numbers, bank account details, and the content of POSH, anti-ragging and SC/ST complaints are encrypted at the field level, as are the payment and government credentials your university supplies.
An audit trail
Sensitive changes, such as marks, results, fee waivers, role changes and password changes, are recorded in a tamper-evident chain that can be checked for alteration.
Personal data rights
Consent is tracked, students can download their data, erasure requests are handled with an exception for academic records, and retention rules are configurable by data category.

Not built yet

If any of these is a requirement for your university, tell us when you book a demo.

Ask us about your security requirements.