- No ISO 27001, SOC 2 or similar certificate yet, and no audit towards one.
- No independent penetration test yet.
- File checking is a careful heuristic, not an antivirus engine. A real scanner is planned.
- Secrets live in the hosting settings, not a managed vault. That changes before a second school.
- Multi-factor sign-in is available through Auth0 but the product does not yet ask you to turn it on.
- We have not promised a recovery point or recovery time, and the database is a single instance.
- Nobody is paged at night. There is a public status page and operator alerts.
- No web application firewall beyond what Azure includes.
- One region. If your trust needs data kept in India, tell us before you sign: moving the database is a restore and a settings change, not yet done.
Checked 25 October 2026
Security and privacy
A school entrusts us with children's records and money. Here is what we do about it, where the data lives, and, just as important, what we do not have yet. If a line here is not true of the product you are shown, tell us.
What protects your data built and running today
Sign-in
Passwords or single sign-on through Auth0. Sessions are short (15 minutes) and refresh tokens rotate; reusing an old one ends every session. Signing out really ends the session. Five wrong passwords lock that email for 15 minutes.
Schools are kept apart
Every record belongs to one school, and every read and write is filtered by it on the server. Parents see only their own children; teachers only their own classes.
Roles you can trust
Standard roles plus custom roles you build from a checklist. A custom role can never hold the powers that run the school itself, or the payment keys.
An audit trail you can read
Changes to students, fees, payroll, staff, roles and settings are recorded with who, when, what and why. Looking up the most sensitive records (an Aadhaar number, a counselling note) is recorded too.
Sensitive fields
Aadhaar numbers are encrypted and shown masked; revealing one needs a reason. Your own Razorpay keys are encrypted, never shown again and never kept in the browser. Fees are paid into your account, not ours.
Uploads
Only allowed file types, checked against what the file really is; executables and test-malware strings are refused; size limits per file and per school; downloads use links that expire.
In transit
Everything is served over HTTPS and the database connection is encrypted.
If we ever need to look
Our staff can act as your user to help only for 30 minutes at a time, with a reason recorded in your own audit trail and a banner on screen.
Children's data law (DPDP)
Consent captured and withdrawn per purpose, a register of purposes, requests for a copy, correction or erasure on a 30-day clock, a breach register with a 72-hour clock, a named grievance officer.
Backups
Backups can be taken, checked and restored; a restore has been rehearsed and the counts matched.
Accessible
Every page is checked against WCAG 2.1 level A and AA on every build.
Where your data lives
Database
TiDB Serverless, Singapore.
Application
Azure, Central India.
Files and photographs
In the database, so also Singapore.
Sign-in
Auth0 (EU): your email address and sign-in events.
Payments
Razorpay, in your own account. Card and bank details never reach us.
Email, if you turn it on
Resend: the recipient's address and the message.
What we do not have yet so you do not have to find out later
Want the security questionnaire answered, or to speak to someone about your trust's requirements? care@schoolios.in.