Security
Your institute's data, kept safe
Student records and fee data are sensitive. Here is, in plain words, how we protect them.
Access control
Each staff member starts from a role template, such as admin, counsellor or accountant, which carries only the permissions that job needs. Admins can then grant or remove individual permissions for a person, so a front-desk user can record a payment without being able to change your course catalogue.
Permissions are checked on our servers for every request. Hiding a button in the screen is only a convenience; the server decides what is allowed and never trusts what the browser claims.
Sign-in uses secure session cookies that scripts in the browser cannot read, with protection against cross-site request forgery.
Data isolation
Every record belongs to an institute and a branch, and every query is limited to the signed-in person's own scope. The database adds a second layer with row-level security, so one institute's rows stay out of reach of another institute even if application code made a mistake.
Encryption
All traffic to the site and the app uses HTTPS, and our website tells browsers to always connect securely (HSTS).
Where data lives
- Render (Singapore) — Application hosting and database.
- Supabase (India (Mumbai)) — File storage.
See every service we use in the subprocessors list and our data processing agreement.
Backups
Database backups are managed by our database provider. Ask us if you need details for your own compliance needs.
Email and files
Uploaded files such as photos, logos and attachments are kept in a private storage bucket. They are never public: each file is served through a time-limited signed link, which expires on its own.
Email is sent through a dedicated transactional email provider; access keys stay on our servers and are never sent to your browser.
Reporting a vulnerability
If you believe you have found a security problem, please email [email protected] with the details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data. We will acknowledge your report and keep you updated.
Ready to leave the paperwork behind?
Start free during early access, or book a 30-minute demo and we will walk you through it.