Security

In transit and at rest

Everything is served over TLS, and the database sits on our own hardware in our Pune data centre rather than on a shared host. Credentials you store are encrypted at rest and never returned by any API, including to you.

Codes, passwords and sessions

One-time codes are stored only as a keyed hash and expire in minutes. A password, where a product has one, is stored only as a salted hash and can never be read back, by us or by anybody who takes a copy of the database. A session can be ended from your account at any time, and ending it takes effect immediately.

One school cannot see another

Which school’s data a request may touch is decided by the signed session on the server, never by anything the browser sends. Changing an identifier in a URL does not change what you can reach.

No password to steal

Sign-in is a one-time code to your email or mobile, so there is no password in our database at all.

Who among us can look

Access to production systems is limited to the engineers who need it, and administrative access is logged. No system is perfectly secure and we will not claim otherwise.

Phone numbers and email addresses are shown masked

On lists and record pages a mobile number appears as 98******10 and an email address as da*******@gmail.com. Somebody who works at the school can copy the whole value of a member of staff, a guardian, an applicant or a driver, and each copy is recorded in the audit log: who, whose record, which detail and when, never the value itself.

Who can see what

Access is granted by role and checked on every request rather than only in the interface. Nobody at Nextyug Technologies Private Limited reads your data as a matter of course; where a person needs to look at a record to answer a support request, the access is recorded and kept for at least a year.

If you find a problem

Write to [email protected] with enough detail to reproduce it. We will acknowledge within two working days and tell you what we are doing about it. We will not threaten you for reporting something in good faith.

If a breach affects you, we tell you and the Data Protection Board without delay, and follow with a full report within 72 hours.