Engineered with Enterprise-Grade Security Controls
We treat student privacy, parent records, and school financial data with the highest technical rigor. Here is an overview of the controls implemented across NaySha EduCore.
Multi-Tenant Isolation & PostgreSQL RLS
Every school's data is strictly partitioned. PostgreSQL Row-Level Security (RLS) policies enforce school-level isolation across students, teachers, fees, and exam tables, preventing unauthorized cross-tenant data access.
Resilient Distributed Rate Limiting
Public endpoints and admission enquiry APIs are protected by distributed sliding-window rate limiters backed by Upstash Redis with bounded 1,500ms AbortSignal timeouts and bounded in-memory fallbacks.
Role-Based Access Control (RBAC)
Separate authorization boundaries for School Administrators, Teachers, Parents, and Super Admins. Server-side session verification strictly validates user roles before executing any administrative query or mutation.
Database Error Sanitization
Raw PostgreSQL exceptions, schema definitions, table names, and constraint keys are stripped and sanitized server-side before returning user-friendly messages to the client.
Canonical Phone Number Verification
Indian mobile numbers submitted via public forms undergo canonical 10-digit normalization, preventing rate-limiting evasion and blocking automated spam from triggering unwanted WhatsApp notifications.
Encrypted Transport & Strict Security Headers
Enforced HTTPS/TLS with HTTP Strict Transport Security (HSTS), X-Frame-Options (DENY to prevent clickjacking), X-Content-Type-Options (nosniff), and restrictive Content Security Policies (CSP).
Location Privacy for Attendance
Device GPS coordinates are accessed only on-demand when a teacher initiates attendance check-in or check-out. NaySha EduCore does not run background location tracking or sell user data.
Continuous Audits & Hardening
The codebase undergoes structured technical audits and vulnerability remediations to maintain high uptime, resilient API performance, and data integrity for operating schools.
Responsible Disclosure & Support
If you have questions regarding our security architecture, data handling procedures, or wish to report a security vulnerability responsibly, please contact our engineering security lead at support@naysha.online.