Security & compliance
How Devryon keeps student, parent, and school data safe.
DPDP Act 2023 alignment
This page is maintained by Devryon EdTech Solution to describe the practices we apply for schools operating under India's Digital Personal Data Protection Act, 2023. It is not an independent certification. We collect only the data a school needs to operate — admissions, attendance, academics, fees, and communication — with lawful basis, purpose limitation, and a documented deletion policy.
India data residency
Devryon databases and file storage for Indian institutions are hosted in India-region infrastructure. Data does not leave the country for ordinary operations.
Encryption in transit & at rest
All traffic uses TLS 1.2+ (HSTS enforced). Databases and backups are encrypted at rest using AES-256. Passwords are hashed with modern algorithms; we never store plain text.
Daily backups + point-in-time recovery
Automated daily encrypted backups with 30-day retention. Point-in-time recovery for the last 7 days. Backups are stored in a separate region within India for disaster recovery.
Role-based access
Every user (admin, teacher, accountant, parent, student) sees only what their role permits. Row-level security is enforced at the database layer, not just the UI.
Audit logging
Sensitive actions — fee refunds, mark changes, user role edits — are logged with actor, timestamp, and IP for accountability.
Frequently asked
- Where is our school's data stored?
- Indian schools are hosted on India-region cloud infrastructure. Backups stay within India.
- Who can see student data?
- Only users your school explicitly authorises. Parents see only their own children. Teachers see only their assigned classes. Admins see what you scope them to.
- Do you sell or share data with third parties?
- No. We never sell, rent, or share school data with advertisers or third parties. Payment gateways and SMS providers receive only the minimum data required to complete a transaction.
- What happens if we cancel?
- You get a full export (CSV + PDF) of your data. After a 30-day grace period we permanently delete your production data. Backups age out on their normal schedule (≤90 days).
- How do we report a security issue?
- Please send security concerns to our security contact link on this page. We acknowledge reports within 1 business day.
This page is maintained by Devryon EdTech Solution and describes practices we apply today. It is not a certification and is not legal advice. For a signed DPA (Data Processing Addendum) or vendor security questionnaire, write to info [at] devryon.com.