Data Security — EduPay

Security Infrastructure

EduPay is hosted on ISO 27001 certified infrastructure with multiple layers of protection. We treat your institute's financial data with the same rigor as a bank treats its deposits.

🔐

256-Bit AES Encryption

All data at rest is encrypted using AES-256, the same standard used by banks and government agencies worldwide.

🔒

TLS 1.3 in Transit

Every connection between your browser and our servers uses TLS 1.3 — the latest and most secure transport protocol.

🛡️

DDoS Protection

Enterprise-grade DDoS mitigation ensures your platform stays online even during large-scale attacks.

📋

Audit Logging

Every action is logged with timestamp, IP, and user identity. Full audit trail available for compliance reviews.

🧬

Role-Based Access

Granular permissions ensure staff only see what they need. Super admins, institute admins, and viewers — each with scoped access.

🔄

Automated Backups

Real-time replication across multiple availability zones with point-in-time recovery. Your data is never at risk.

Compliance & Certifications

We maintain active compliance with industry standards and regulatory requirements relevant to Indian financial technology.

🏛️

ISO 27001

Information Security Management

🏦

RBI Compliant

Payment & Settlement Systems

📜

PCI DSS

Payment Card Industry Standards

🇮🇳

IT Act 2000

Indian Cybersecurity Law

Data Privacy Promise

We never sell your data. We never share student information with third parties for marketing. We never use your financial data for anything other than providing the EduPay service to your institute.

Your institute's data belongs to you. We are merely custodians. You can request a full data export at any time, and we will provide it within 48 hours in a structured, machine-readable format.

What We Collect

Institute Data: Name, address, KYC documents, bank account for payouts, fee structure configurations.
Student Data: Name, enrollment ID, contact details, fee dues, payment history, VBAN assignment.
Transaction Data: Payment amounts, methods, timestamps, UTRs, settlement records.
Staff Data: Name, role, salary details, attendance records (if payroll module is used).

How We Protect It

Data is encrypted both at rest (on disk) and in transit (over the network).
Access is restricted by role — a bus fee coordinator cannot see payroll data.
All database queries are parameterized to prevent SQL injection.
API endpoints are rate-limited and authenticated with JWT tokens.
Third-party integrations (Razorpay, banks) use OAuth 2.0 with scoped permissions.

Incident Response

In the unlikely event of a security incident, our response protocol is:

Detection: Automated monitoring alerts within 60 seconds of anomaly detection.
Containment: Affected systems are isolated immediately to prevent spread.
Notification: Affected institutes are notified within 4 hours with full details.
Resolution: Our engineering team works 24×7 until the issue is fully resolved.
Post-Mortem: A detailed report is shared with affected parties within 72 hours.

Security Reporting

Found a vulnerability? We appreciate responsible disclosure. Please email security@edupays.in with details. We commit to:

Acknowledging your report within 24 hours.
Providing a timeline for the fix within 72 hours.
Publicly crediting you (with your permission) in our security hall of fame.

📧 Contact Security Team

Your Data, Our Priority