Data Security & DPDP Compliance
The safeguards behind every byte your institution stores in Instita OS.
Tenant Isolation
Each institution operates inside a dedicated tenant boundary enforced at the database layer (row-level security). No user of one institution can access another’s records — even through the API surface.
Encryption
All traffic is encrypted in transit (TLS). Data at rest is encrypted on managed infrastructure. Credentials are never stored in plain text; authentication uses modern token-based flows.
Access Control
Granular role-based permissions — fee clerk, teacher, admin, platform staff — enforced server-side on every request. Platform staff access to tenant data is logged and requires authorization.
Auditability
Sensitive actions (financial transactions, certificate issuance, user management, data changes) are recorded in an append-only audit trail attributable to the actor.
DPDP Act, 2023 Alignment
We process personal data only for the service purpose, honor data-principal rights through institutional channels, maintain safeguards, and notify affected parties of reportable incidents as required by Indian law.
Backups & Continuity
Institutional data is backed up with point-in-time recovery support. Destructive operations are gated behind confirmation and audit review.
Last updated: October 2026 · Security queries: support@instita.in