How does Acavya protect my institute’s data?

Where is my data stored?

The primary database and cache use Azure; the application is hosted in Mumbai. Private Cloudflare R2 is selected for uploaded documents. Its Asia-Pacific placement hint does not guarantee India-only file storage. The Cloudflare location documentation explains this limit. The sub-processor list gives the final provider details.

Some services that you choose to use do touch other systems: WhatsApp and SMS delivery networks, payment partners, and optional AI providers. AI providers receive only redacted text, never images of identity documents. The sub-processor list names each provider in use, with the data it receives and where.

How are institutes kept apart from each other?

Think of one building with a separate locked room per institute, where the lock is built into the database. Every record carries its institute’s ID, and the database refuses to return a row that belongs to another institute, even if a developer makes a mistake in application code. Our build rules require automated tests that try to read across institutes on every route.

Inside one institute, access depends on role and scope: a class teacher sees their own class, an accountant sees fees, a parent sees only their own children. If you ask for something outside your scope, the answer looks the same as if it did not exist.

What is encrypted?

• All traffic between your device and our servers uses TLS.
• Sensitive fields such as health data and counsellor notes are encrypted with keys specific to your institute.
• Aadhaar numbers are never stored in full: only the last four digits and a keyed hash, so a record can be matched but not read back.
• Passwords are stored only as slow, salted hashes. Production sign-in uses verified email codes, with a fresh code for sensitive actions and device approval when required.

What is written to the audit log?

Money, marks, attendance edits, certificates, consents and permission changes are written to an append-only, hash-chained audit log, so tampering is detectable. Discounts, receipt cancellations and marks changes can require a second person to approve (maker-checker). Receipt numbers are never reused.

Can Acavya staff see my data?

Only through break-glass access: the person gives a reason, the access is time-limited, every action is logged and the institute is notified. There is no shared database or login with our other businesses, and no Acavya marketing tool can reach your data. Read the No-Poach and Data Ownership Pledge.

How are AI features kept safe?

• Names, phone numbers, emails, Aadhaar-like numbers and addresses are replaced with tokens before any text goes to a model.
• Images of identity documents or answer sheets are never sent to providers that may keep or train on inputs.
• Each AI feature has a non-AI fallback, a usage limit and a human approval step for anything that changes a record.
• Parents and students are told when AI is used on their data, and you can switch AI features off per institute.

What is our CERT-In and DPDP posture?

We built Acavya to help you meet the rules, and we make no certification claims; no DPDP certification exists. We follow the CERT-In Directions of 28 Apr 2022: report listed cyber incidents within 6 hours, keep ICT logs in India for 180 days, synchronise clocks to a traceable source and name a point of contact. For your side of the law, see DPDP readiness.

How do I report a security problem?