Trust centre
How your data is held, in plain words.
Where it lives, what separates one school from another, who can read it, and the things we deliberately do not do. Everything on this page can be checked in a demonstration.
The five facts that matter
Hosted in India
Your data sits in Mumbai. It is not replicated abroad, and it is not moved for convenience.
Separated in the database
Which rows a person can read is decided by row-level security in Postgres, enforced for every query including ours. It is not a where-clause in application code that somebody could forget.
The app cannot bypass it
The account the application connects with is explicitly unable to override row security. Even a mistake in our code cannot read across the wall.
The public data interface is closed
There is no open API endpoint sitting in front of the database. Every read goes through the application, which is where the checks are.
Proven on every release
Thirty-six isolation test suites run before anything ships, and they fail the release if one institution can see another's rows.
Passwords are not ours to see
They live in the identity provider's own store, which no signed-in user of any kind — including us — can read.
What we do not do
We do not train models on your children's data
Not for our benefit, not for a vendor's. It is not used for training at all.
We do not sell or share data
No advertising networks, no data brokers, no analytics vendor receiving a child's record.
We do not hold your fee money
Payments move between a family and the school's own account. We are not in the flow of funds.
We do not let a school see a family's own purchases
What a parent buys for home is invisible to the institution, by design.
Questions worth asking any vendor
These are the ones we would ask, and our answers to them.
- Where exactly is our data?
- In Mumbai, ap-south-1. Backups are held in the same region.
- Can Edustians staff read our records?
- Support access is possible and is logged, and it happens against a specific institution rather than across all of them. Every action is recorded with who did it.
- What happens if we leave?
- You export your data in a standard format and we delete ours according to the retention terms. Both are things you should get in writing from any vendor.
- Have you been audited?
- Not yet, and we will not imply otherwise. What we have is an automated suite that proves isolation on every release, and we will show you it running.
- Do you have a breach process?
- Yes, written down, including notification obligations under the DPDP Act. Ask for it at a demo.
We are a young company and this page will grow. If something you need is not here, ask — and if the honest answer is that we have not done it yet, that is what you will get.
Bring your IT person to the demo.
This is the part of the hour we least mind spending. Ask to see the isolation tests run.