How Saarthi Protects Your School

Your school's data is encrypted, isolated, and stored in the APAC region. We follow the principle of data minimisation and comply with the DPDP Act 2023.

• All data stored in the APAC region (Singapore)
• AES-256 encryption at rest on all databases and file storage
• TLS 1.3 for all data in transit — no exceptions
• Location data minimised at the schema level — no unnecessary identifiers stored
• No behavioural analytics, no ad tracking, no third-party tracking SDKs
• DPDP Act 2023 compliance built into the platform from day one

Every layer of our infrastructure is hardened. From network isolation to security headers, we defence-in-depth.

• TLS 1.3 on every endpoint — HTTP automatically redirected to HTTPS
• HSTS header enforced across all domains
• Security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy
• Redis on internal network only — never exposed to public internet
• Isolated services: API, GPS ingest, Celery worker — each with limited access
• All secrets in environment variables — zero hardcoded credentials in code

Secure, short-lived tokens and strict role enforcement ensure only authorised people see your data.

• JWT tokens with secure refresh flow and automatic session renewal
• OTP authentication with SHA-256 hashing and timing-safe comparison
• Role-based access: school_admin, teacher, driver, parent, super_admin
• Row-Level Security (RLS) on all school-scoped tables — database-level tenant isolation
• Session revocation on logout, password change, or account deactivation
• Tokens stored in secure enclave (iOS Keychain / Android Keystore)

Protecting children's data is our highest priority. Access to student information is strictly limited and audited.

• Student location data accessible only to registered guardians and school admin
• GPS tracking requires explicit parental consent under DPDP Act
• Student photos served via signed URLs with 1-hour expiry — no permanent public links
• Boarding notifications sent only to the specific child's guardians
• Driver app shows only their assigned route's student manifest
• No bulk export of student location or personal data

Payment processing is handled entirely by Razorpay. We never touch your card data.

• Razorpay handles all card data — PCI-DSS Level 1 compliant
• Saarthi never stores card numbers, CVV, or payment instrument details
• Only transaction references, amounts, and timestamps recorded
• Webhook verification with HMAC signature validation on every payment event
• All payment data encrypted at rest
• INR-only transactions with Indian banking rails

We monitor our systems 24/7 and have a documented incident response plan for every scenario.

• 24/7 automated monitoring of all services (API, GPS, frontend)
• Alerts to engineering team for any anomalies
• Incident response: P0 issues acknowledged within 15 minutes
• Breach notification: affected schools notified within 4 hours
• Status page hosted on separate infrastructure (status.saarthischools.in)
• Post-mortem written within 48 hours for any P0 incident

Automated security scanning, dependency audits, and regular penetration testing keep us honest.

• Automated security scanning: Bandit (Python SAST), Semgrep, Gitleaks (secret detection)
• Dependency audits: pip-audit and npm audit run in every CI pipeline
• Branch protection on main: require PR review, no direct pushes
• Third-party security audit planned before scaling to additional schools
• Annual security reviews after major architecture changes
• Dependabot configured for automatic security patch PRs

You own your data. We make it easy to access, correct, or delete anything we hold.

• Parents can request access, correction, or deletion of their data
• School data export available before offboarding
• PII purged within 30 days of deletion request
• GPS data retained for 90 days, then automatically deleted
• Financial records retained for 7 years (regulatory requirement)
• Grievance officer: privacy@saarthischools.in — 48h acknowledgement, 30-day resolution