Security & Privacy

Your institution's data, kept separate

EduTask holds student records, staff records and fee transactions. This page describes how that data is separated, who can reach it, and what is recorded when someone does — in terms you can verify with us, not marketing language.

How the platform is built

A dedicated database per institution

Every institution runs on its own database, not a shared one with a filter applied. A query written for one institution has no path to another's records, because the data is not in the same place. This is the strongest separation guarantee on this page.

Role-based access control

Access is granted per role — administrator, teacher, accounts, library, transport, hostel, security and more — and each role carries an explicit permission set. A teacher cannot open fee collection, and an accounts user cannot alter examination marks, unless you grant it.

Audit trail on record changes

Changes to student, staff, fee, examination and configuration records are recorded with the user who made them and the values before and after. When someone asks who changed a mark or reversed a receipt, the answer is in the system rather than in memory.

Support access is logged

When our team accesses your workspace to help with a problem, the operator, the account reached, the action, the IP address and the browser are all written to a log. Support access is not invisible to you.

Payments never touch our servers

Online fee payments run through your chosen gateway — BillDesk, Easebuzz, NTT Data or PayPhi. Card and bank credentials are entered on the gateway, not in EduTask. There is no card number field anywhere in our database.

Session and API tokens expire

Mobile and API sessions carry an expiry set at login rather than living indefinitely. Public forms are protected by reCAPTCHA, which is scored rather than a checkbox, so automated submissions are rejected before they reach a person.

What we do not claim

Plenty of software in this category displays certification badges it has not earned. Ours is a short and accurate list instead.

  • ISO 27001, SOC 2 or HIPAA certificationNot held. We do not display these badges and you should ask any vendor who does for the certificate and its scope.
  • A formal DPDP Act compliance certificationNo such certification is held. We are happy to walk through how the platform handles personal data so your own assessment can be made.
  • A published uptime SLAWe do not publish an availability figure we have not committed to contractually. Availability commitments are agreed per contract.
  • Two-factor authenticationNot currently available. Access is protected by password authentication and role-based permissions. If 2FA is a requirement for your institution, tell us — it helps us prioritise it.

If your procurement process requires a specific certification or a completed security questionnaire, tell us what you need and we will answer it honestly, including where the answer is no.

Reporting a security issue

If you believe you have found a vulnerability, email us with the details and we will acknowledge it. Please give us a reasonable window to investigate before disclosing it publicly.