How we look after institutional data.

Where your data lives

Each institution is the Data Fiduciary for its students' data; we process it on the institution's instructions.

• Application servers and database backups in AWS Mumbai (ap-south-1)In production
• A dedicated server for an institution that wants its own, with files kept in AWS MumbaiIn production
• Several institutions on one system, with each institution's data kept separateIn production
• HTTPS on every address, including the institution's own domainIn production

On our shared deployment, uploaded files are stored with Cloudflare R2, which does not offer an India-only location, and some AI features call model providers outside India. We list these for each institution before go-live. That is why we say "servers in India" and name the exceptions.

Sign-in and access

People see what their post allows, and every unusual step leaves a record.

• Strong password rules, with common passwords refusedIn production
• Account lockout and CAPTCHA after repeated failed sign-insIn production
• Two-step sign-in with an authenticator appIn production
• A password change signs the account out on every deviceIn production
• Roles that follow the org chart: a dean sees their own schoolIn production
• Temporary access for set dates that ends by itselfIn production
• Access review: who holds admin access, and whyIn production
• Two-step sign-in made compulsory for admin staffSwitched on per institution
• Google Workspace, Microsoft 365 or SAML single sign-on, configured with your IT teamAvailable on request
• Passkeys: fingerprint, face or a security keyAvailable on request

Audit trail

Built so that an assessor, an auditor or your own IT team can check what happened.

• Activity log of who did what, when and from whereIn production
• Hash-chained activity and admissions logs, so an edited entry shows upIn production
• A one-click check that no log entry was alteredIn production
• Uploaded documents open only for people allowed to see themIn production
• Approvals, result changes and moderation recorded with a reasonIn production

Privacy and the DPDP Act

Designed for the Digital Personal Data Protection Act, 2023 and its Rules. We say "designed for" rather than "certified" because there is no official DPDP certification.

• Consent recorded per purpose, against the version of the notice shownIn production
• Guardian consent by one-time code for applicants under 18In production
• Applicants can download, correct or erase their dataIn production
• Aadhaar numbers detected and removed automatically, never storedIn production
• Alerts on bulk exports and sign-in attacksIn production
• A written breach plan covering CERT-In and the Data Protection BoardIn production
• Retention schedule per data category, with preview and legal holdSwitched on per institution
• Field-level encryption for guardian contacts and private notesSwitched on per institution

Responsible AI

In every AI feature, the AI drafts and a person decides.

• No student personal data is sent to AI modelsIn production
• The admissions assistant cites its source and hands over to a counsellorIn production
• Everything the assistant says starts as a draft that a person publishesIn production
• AI notes and summaries reach students only after the teacher approves themIn production
• AI draft marks are suggestions; the evaluator decidesIn production
• Proctoring gathers evidence and an integrity report; the proctor and exam cell decideIn production
• AI usage and cost shown in rupees, by featureIn production
• AI switched on or off per institution, with a daily budgetSwitched on per institution

Reliability and backups

How we test and release changes, back up your data and check uptime.

• Automated tests and a person's approval before every releaseIn production
• Every release tried on a separate test copy first, and the same build promotedIn production
• Nightly database backups kept off the server, with a copy locked for 30 daysIn production
• Uptime checked every two minutes from another serverIn production
• Test and demo copies cannot message, charge or reach real peopleIn production

Load testing: on our scalable reference set-up, the platform held 20,000 concurrent simulated students with no errors in two runs, and stayed steady through a four-hour soak test. Your deployment is sized to your numbers and exam days; we share the full test report with your IT team.

Services we use

The outside services we and a deployment may rely on: the same list as section 11 of our Privacy Policy. We confirm the exact list for your institution in writing before go-live.

What we don't claim

Some trust pages list badges. We would rather tell you where we stand.

• We do not hold ISO 27001 or SOC 2 certification today.
• We have no third-party penetration-test report to share yet.
• We do not publish an uptime SLA; we agree service levels per contract.

Report a vulnerability

If you believe you have found a security problem in any Divyarshi AI product, email info@divyarshiai.com with the subject "Security report". Include steps to reproduce, and please don't access other people's data or disrupt service while testing.

We acknowledge reports within two working days and keep you informed until the issue is fixed.