Where it lives, and who can reach it
Nothing is replicated across a border for convenience.
- Where does our data live?
- Primary and standby databases, document storage and backup snapshots are held in your own region — India for Indian institutions, and the corresponding region elsewhere. The exact regions are named in the security documentation shared during evaluation.
- Who else touches it?
- Every third party that touches your data — hosting, payments, messaging — is listed by name and purpose. You are told before that list changes.
- Who can see what?
- Access is set by campus, department, programme and role. A class teacher sees their sections. A hostel warden sees residents, not marks. Financial and health information is restricted separately from everything else.
- Who changed what?
- Create, update, approve, export and every AI action is written to an audit trail with the actor, the timestamp and the previous value. Marks and fee entries keep a full revision history, so a changed grade can always be traced to a person.
- How do staff get access, and lose it?
- Google Workspace, Microsoft Entra ID and SAML. Staff accounts are created and closed from your directory, so a departure removes access immediately rather than whenever somebody remembers.
- Can iVake staff see our records?
- Support access to a live institution requires a reason, is time-bound, and is logged in the same audit trail you can read. Nobody at iVake browses your records casually.
Encrypted, backed up, and recoverable
What protects a record, what brings it back, and what keeps the service standing.
In transit and at rest
- TLS on every connection, including the mobile apps
- Encrypted storage for documents and database backups
- Signed URLs with expiry for marksheet and certificate downloads
- Credentials hashed, never recoverable in plain text
Backups and recovery
- Automated daily backups, retained on a defined schedule
- Point-in-time recovery within the retention window
- Restores are tested, not assumed
- Backups encrypted and held in the same region as the primary
Keeping it standing
- Standby database with automatic failover
- Monitoring and alerting on availability and errors
- Rate limiting and abuse protection on public endpoints
- Release notes and advance notice for planned maintenance
Built for the DPDP Act, and for children's data
Under India’s Digital Personal Data Protection Act 2023 your institution is the Data Fiduciary and iVake is a Data Processor acting on your instructions.
- Can we evidence consent?
- Notice and consent are captured at the point a parent or applicant submits data, with the purpose recorded alongside it. Withdrawal is recorded the same way.
- How are children treated?
- The Act sets a higher bar for anyone under eighteen: verifiable parental consent, and no tracking, behavioural monitoring or targeted advertising aimed at children. The DPDP Rules 2025 exempt educational institutions from the consent and tracking rules only where tracking and monitoring are for education or children’s safety, and these duties start in May 2027. iVake does no advertising, no behavioural profiling and no ad-tech tracking of students. There is nothing to switch off.
- How do we answer a rights request?
- Access, correction and erasure requests can be answered from one student record rather than assembled across systems. Erasure respects the retention you are legally required to keep — academic records that a board or university mandates are not silently deleted.
- What happens in a breach?
- If a personal data breach affects your institution we notify you without undue delay, with what we know and what we are doing, so you can meet your own reporting duty to the Data Protection Board and to affected people.
This describes how the product is built. It is not legal advice, and your institution remains responsible for its own compliance.
What IT committees ask first
Ask for the security documentation and the DPA with its sub-processor list, or send your own questionnaire. If an answer is no, it will say no rather than something that reads like yes.
Do you hold ISO 27001 or SOC 2?
We give our current certification status in writing during evaluation, alongside the security documentation and sub-processor list. We do not display a badge for an audit we have not completed, because a badge is the one claim a procurement team will check.
Do you use our data to train AI models?
No. Your records are processed to answer the request in front of them and for nothing else. They are not used to train or fine-tune any model, ours or a third party's, and they are not pooled with other institutions' data.
What happens to our data if we leave?
You get a full export of every record and document in open formats, on request, at any point — including after the contract ends. Deletion then follows the schedule in the agreement. We do not hold data hostage to keep a customer, and we will not make you ask twice.
Do you carry out penetration testing?
Ask us for the current testing position and scope during evaluation and we will tell you what has been done and when. If your institution wants to run its own test against a staging environment, we will arrange it.
Where people go from here
Implementation
- Migration, and who handles your data during it
Privacy notice
- How personal data is handled and for how long
Accessibility
- Conformance, testing, and what is not yet verified
See iVake running on your own data
Share your fee structure and programmes before the call, or sample data with student names removed. We set them up, so you see your own institution on screen rather than a demo account.
- 45 minutes, your data. Not a generic tour of features.
- Migration mapped on the call. We show exactly where your current records land.
- A written rollout plan within two working days, with phases, owners and dates.
- No pressure to switch everything at once. Most schools and colleges start with one department or one intake.