Security & Data Protection

1 Isolated data per school

Every school runs on its own separate database — one school can never see or reach another school’s data. Access is scoped per account and per role, so staff only see what their role permits.

2 Encryption

Data is transmitted over encrypted HTTPS/TLS. Passwords are never stored in plain text — they are salted and hashed with a modern one-way algorithm (bcrypt). Payment details are handled by PCI-compliant gateways (Razorpay) and never stored on our servers.

3 Access control & authentication

• Role-based permissions (admin / teacher / accountant / custom) limit who can do what.
• Brute-force protection, session hardening (idle timeout, device fingerprint) and CSRF protection on every form.
• Optional two-factor authentication for platform operators.

4 Backups & recovery

School data can be exported at any time, and routine backups help protect against loss. Admins can download a full database backup on demand from within the app.

5 Application hardening

The platform uses parameterised database queries (to prevent injection), validated and type-checked inputs, a strict content-security policy, secure file-upload validation, and an audit log of sensitive actions.

6 Responsible disclosure

Found a security issue? Please report it privately to softcoreaxis@gmail.com so we can investigate and fix it quickly. We appreciate responsible disclosure.