Last month, a principal in Vadodara asked me a question that stopped me cold: "If your company shuts down tomorrow, what happens to my students' data?"
It is a fair question. And honestly, most EdTech companies do not have a good answer to it. They store data on shared servers, in formats only their platform can read, with no export mechanism. If the company folds or raises prices, the school is stuck.
We decided early on that we would never put a school in that position.
What Student Data Actually Means
When we say "student data," people think of names and grades. But in practice, the data we handle includes:
- Aadhaar-linked family information (where provided)
- Medical records and allergy notes
- Behavioral incident reports
- Parent financial information (fee payments, scholarship status)
- Teacher performance assessments
This is deeply sensitive information. A leak does not just violate privacy — it can cause real harm to families. We take this personally.
Our Security Architecture
Data Stays in India
All Anubodha data is stored on Indian servers. We do not use any cloud region outside India. This is not just a compliance checkbox for the Digital Personal Data Protection Act (DPDPA) 2023 — it is a principle. Indian student data belongs in India.
Encryption at Every Layer
Data is encrypted in transit (TLS 1.3) and at rest (AES-256). But we go further. Sensitive fields like Aadhaar numbers and medical records are encrypted at the application layer too, so even our own database administrators cannot read raw values without explicit key access.
Role-Based Access That Actually Works
A class teacher can see her students' grades. She cannot see the fee payment status of those students' families. The accountant can see fee data but not academic records. The principal sees everything, but even the principal cannot access another school's data. Every access is logged and auditable.
Your Data, Your Export
Any school can export their complete data — students, grades, attendance, fees — in standard CSV format at any time, with no questions asked. If you ever want to leave Anubodha, your data comes with you. We believe this is the only ethical approach.
The DPDPA 2023 and What It Means for Schools
India's Digital Personal Data Protection Act is still being implemented, but the direction is clear: organizations handling children's data will face higher scrutiny. Schools need to be able to demonstrate:
- Verifiable parental consent for data collection
- Clear data retention and deletion policies
- Breach notification mechanisms
We have built all three into the platform from day one. Not because the law required it yesterday, but because we knew it would tomorrow.
What We Ask of Schools
Security is a two-way street. We ask our partner schools to keep login credentials private, train staff on basic security hygiene, and report any suspicious activity immediately. In return, we provide security training as part of every onboarding session — in the local language, with practical examples.
Because the best security system in the world is useless if the people using it do not understand why it matters.