← Back to home

Security and data handling

We treat security and responsible data handling as a first priority. Protecting institutional and student information is one of the most important responsibilities of any web application.

How the system is protected

Encrypted traffic

Connections to the public service are encrypted in transit. Edge controls screen abusive requests before they reach the application.

Role-based access

Passwords are stored as hashes. Institute administrators, teachers, and scanners receive different permissions.

Protected file links

Answer sheets and reports are delivered through authenticated or time-limited links, not open public file locations.

Security logs

Authentication events and security-relevant requests are logged for review and incident response.

How data is handled

The institution decides why student data is uploaded. EduSathi processes it to provide the requested grading, storage, and reports.

Retention policy

Answer sheets are retained for up to 180 days after grading, unless the institution requests earlier deletion.

Security and access logs

Retained for up to 90 days; an investigation or legal requirement may require longer retention.

Account data

Kept while the account is active and deleted within 30 days of a verified erasure request, subject to legal retention.

Data sharing and advertising

We do not sell personal data. Service providers process only the limited data needed for hosting, storage, grading, email, or payments. Student data is not used for advertising or to train a separate public model.

Export and deletion

Institutions may request export or erasure of the student data they control.

Security review

I am an ethical hacker with the Computer Center at IIT Madras. I use that experience to review EduSathi's architecture, access controls, and operational security.