Security and compliance

Your data, protected at every layer.

Student and staff records are sensitive. Here is exactly how Scholva protects them, in plain language, not legal boilerplate.

How it works

Five layers, working together.

From the database to the settings screen, security is not a separate feature. It is how the product is built.

Encrypted everywhere

Data at rest is encrypted with AES-256. Every connection, browser session and API call runs over TLS 1.2 or higher.

Backed up daily

Daily encrypted backups with a 30-day retention period, so a bad afternoon never costs you a term's worth of records.

Secure hosting

Scholva runs on cloud infrastructure with restricted, multi-factor-authenticated access, and is governed by the laws of India.

Roles and audit trails

Every team and school role, from owner to exam cell admin, gets exactly the permissions it needs and nothing more, with a log of who changed what.

Roles and permissions in Scholva: team and school roles such as owner, admin, teacher, driver and exam cell admin, each with a permission count.

DPDP consent, built in

A consent centre for data processing, notifications, analytics and third-party sharing, plus APAAR and UDISE+ consents, for every family.

The Scholva consent centre for the DPDP Act: toggles for data processing, notifications, analytics, marketing and third-party sharing, plus APAAR and UDISE+ consents.

Compliance

Built for how Indian schools are regulated.

We take the DPDP Act and our obligations as a data processor seriously, in writing, not just in a badge on this page.

Designed around the DPDP Act

Consent management, data export and erasure requests, and an access log, aligned with India's Digital Personal Data Protection Act, 2023.

A Data Processing Agreement for every school

We act as a data processor. A DPA setting out our obligations is available for every institution that asks for one.

Documented incident response

A written incident response plan, regular drills, and notification of the data controller without undue delay, within 72 hours where feasible.

Data portability, no lock-in

Request your data in a structured, machine-readable format at any time. Nothing is held hostage in a proprietary export.

The numbers behind the promise.

99.9%

Uptime

AES-256

Encryption at rest

72hr

Breach notification window

30 day

Backup retention

Questions

Security, answered plainly.

Still have a question for your board or your IT lead? Our team is happy to walk through it.

Contact us

Yes. Data at rest is encrypted with AES-256 and every connection uses TLS 1.2 or higher, whether that is a browser session, an API call or communication between our own services.

We follow a documented incident response plan. Where Scholva is processing data on a school's behalf, we notify the school without undue delay, and within 72 hours of becoming aware of the breach where feasible, along with what is known about its scope and impact.

Yes, at any time and in a structured, machine-readable format. There is no lock-in: the data you put into Scholva is yours to take out again.

Access to production systems is restricted to authorised staff using multi-factor authentication. Inside the product, role-based access control decides exactly what every owner, admin, teacher, parent and student can see, with an audit trail of changes.

Scholva is designed around India's Digital Personal Data Protection Act, 2023: a consent centre, data export and erasure requests, and a Data Processing Agreement available on request. Each school remains the data controller and is responsible for its own compliance obligations.

Yes. A DPA setting out how we process student and staff data on your behalf is available for every school, and our legal team is happy to work through school-specific requirements.