Student and family data, treated like it matters
CampusOS handles attendance, fees, and contact details for real students and families — here’s how that’s protected.
Encrypted in transit
Every connection — web, mobile, and API — is encrypted over HTTPS/TLS. There’s no unencrypted path to your data.
Isolated per institute
Each institute’s data lives in its own isolated schema — not just a shared table with a filter. One institute can never query another’s data.
Modern authentication
Password login with industry-standard hashing, plus one-time-code login over email or SMS — short-lived access tokens and secure refresh.
Rate limiting
Login, signup, and OTP requests are rate-limited per account and per IP to blunt brute-force and abuse attempts.
Audit logging
Sensitive actions — payments, student changes, permission changes — are logged with who did what and when.
Hardened by default
Strict browser security headers, DDoS-protected edge network, and a database backed up with point-in-time recovery.
Role-based access
Every account only ever sees data for its role and institute — students and guardians can’t see other families’ records.
Monitored infrastructure
Production systems are continuously monitored with automated alerting so issues get caught early.
How we think about it
Principles that shape every decision on this side of the product.
Access is scoped as narrowly as possible by default — a teacher can’t see another batch’s fee records, and a parent can’t see another family’s child, by construction, not by convention.
Backups run on a schedule with point-in-time recovery, and infrastructure health is actively monitored with alerting — catch problems before they become incidents.
Encryption, isolation, rate limiting, audit logs, and monitoring work together — so one gap doesn’t become the whole story.
Questions about security?
If you need more detail for your institute’s due diligence, get in touch — we’re glad to walk through it.