Security and trust

How Vacademy protects your institute's data

Learner records, assessments, fees and recordings are some of the most sensitive data an organisation holds. This page sets out exactly how we secure them, from encryption and access control to testing, monitoring and incident response. It covers what your security team will ask.

Request our security pack Report a vulnerability

ISO 27001

Certified information security management

AES-256

Encryption for files and backups at rest

TLS 1.2+

Encryption for every connection in transit

1 h / 4 h

Recovery point and recovery time objectives

Secure by architecture

Security starts with how the platform is put together. Every request passes through four layers, and your data sits only in the innermost one, on a private network.

Your people

Administrators, teachers, learners and parents on web, Android and iOS; partner systems over REST APIs.

Cloudflare edge network

Every request enters here first: TLS 1.2+, DDoS mitigation, web application firewall and bot filtering.

Application tier

Stateless microservices on a multi-node Kubernetes cluster. Every API call is authenticated and checked against the user's role in their own organisation.

Private data tier

PostgreSQL with a live standby replica on a private network that is never reachable from the internet. Files in encrypted, private Amazon S3 storage.

A detailed solution architecture diagram is part of our security pack.

Encryption everywhere

Your data is encrypted whenever it moves across a network and wherever it is stored, with keys kept out of reach of the code.

In transit

TLS 1.2 or higher on every public endpoint, with HSTS. Certificates are issued and renewed automatically.

Files at rest

Course content, answer sheets, recordings and documents sit in private Amazon S3 storage with AES-256 server-side encryption.

Backups

Database backups are AES-256 encrypted before they leave the server, and stored separately from production.

Sensitive fields

HR personal data and third-party access tokens get an extra layer of application-level AES-GCM encryption.

Passwords

Stored only as salted one-way bcrypt hashes. Nobody at Vacademy can read a user's password.

Secrets and keys

Held in encrypted secret stores, never in source code, scanned for on every commit and rotated at least once a year.

Identity and access control

People see only what their role allows, and you decide who that is. Access can be granted, narrowed or removed in seconds.

Single sign-on

Google, Apple and GitHub sign-in for staff and learners, with your own branded Google sign-in screen. SAML 2.0 (Okta, Microsoft Entra ID) is available on request.

Role-based access

Every request is authorised on the server against the user's role in your organisation. Custom roles take granular permissions, and faculty can be limited to specific batches and subjects.

Instant access removal

Disable a user's access without deleting their account. It takes effect on their active sessions at once, and is recorded in the audit log.

Concurrent session limits

Choose how many devices one account may be signed in on. Past the limit, the user must end an existing session first.

IP allow-listing

Restrict sign-in to your office or campus network ranges. Available on request.

Login protection

Rate limiting and attempt caps on password and one-time-passcode sign-in stop credential-guessing attacks.

Built-in roles

Admin
Teacher / Faculty
Course Creator
Evaluator
Mentor
Counsellor
HR Admin
HR Manager
Learner
Parent / Guardian
Custom roles

Vacademy support staff reach the platform only through a separate super-admin role, restricted to an allow-list of named people.

Data privacy and ownership

Your data belongs to you. We hold it only to run Vacademy for you, keep it apart from every other customer's, and give it back or delete it when you ask.

You own your data

We process it only to run the service for you. It is never sold, never shared for advertising and never used to train AI models.

Tenant isolation

Each institute is a separate tenant. One organisation's users cannot see another organisation's records.

Choice of data location

Run on our shared cloud, or on a dedicated deployment in the region you need, including India-only hosting.

Staff access only with consent

Vacademy staff open customer data only to resolve a support request you raised, or with your documented consent. Every such access is logged.

Export and deletion

Export your data at any time. When a contract ends, your data is deleted within 90 days, including from backups as they expire.

Data retention
Data	Kept for
Customer data	For the length of your contract
After contract end	Deleted within 90 days
Learner account deletion request	Access removed at once; personal data deleted or anonymised within 30 days
User activity logs	180 days
Administrative audit logs	1 year
Encrypted database backups	Up to 90 days

Application security

Security is part of every change we ship, from design review to independent penetration testing, and every vulnerability has a fix deadline.

1
Design review
Features that touch sign-in, payments, personal data or tenant isolation get a security review before code is written.
2
Secure coding
Engineers code to the OWASP Top 10 and OWASP ASVS. Server-side authorisation is mandatory on every endpoint.
3
Peer review
Every change merges through a reviewed pull request, supported by AI-assisted code review. The main branch is protected.
4
Automated scanning
Static analysis (GitHub CodeQL), dependency scanning (Dependabot) and secret scanning run on every pull request.
5
Automated delivery
Releases ship only through CI/CD as versioned container images, with zero-downtime rollouts and fast rollback. No one changes production by hand.
6
Independent testing
A CERT-In empanelled auditor runs a penetration test of the web apps, mobile apps and external network every year and before major releases.

Vulnerability fix deadlines
Severity	CVSS v3 score	Deadline
Critical	9.0 – 10.0	Mitigated within 48 hours, fixed within 7 days
High	7.0 – 8.9	Fixed within 15 days
Medium	4.0 – 6.9	Fixed within 30 days
Low	0.1 – 3.9	Fixed within 90 days

Infrastructure and network security

Production runs on hardened, minimal servers behind default-deny firewalls and Cloudflare's edge. Nothing that stores your data faces the internet.

Private network for data

Databases and internal services accept connections only from the private network. Database logins use SCRAM-SHA-256.

Default-deny firewalls

Host and cloud firewalls block all inbound traffic except the few ports the platform needs.

Hardened, minimal hosts

Supported Ubuntu LTS releases with automatic security updates, and configuration aligned with CIS benchmarks and kept as code.

Minimal containers

Workloads run as containers built from minimal Alpine and slim base images, rebuilt on every release.

Intrusion detection

A host-based intrusion detection agent watches every production server for file changes, suspicious logins and unusual processes.

Malware scanning

Every uploaded file is checked against allowed types and sizes, then scanned for malware. Infected files are quarantined and never served.

Vulnerability scanning

External vulnerability scans and CIS configuration scans run every quarter. Dependencies and container images are scanned continuously.

Edge protection

Cloudflare absorbs DDoS attacks and filters malicious traffic with its web application firewall before it reaches our servers.

Monitoring, logging and audit

Every access to your data leaves a record, and the platform is watched around the clock by automated alerting.

User activity log

Every authenticated request is recorded: who, which organisation, what action, from which IP address and device, and when.

Audit trail you can see

Administrative changes are recorded with before and after values. Your administrators can review them in the product.

Real-time error tracking

Sentry watches every service and app and alerts engineers the moment something fails.

Infrastructure monitoring

Prometheus and Grafana track servers, Kubernetes, databases and connection pools, with automated alerts.

Backup and disaster recovery

After a major failure, the platform loses at most 1 hour of data and is back within 4 hours. Those targets are backed by live replication and tested restores.

Live standby database

A second database server receives every change by continuous streaming replication.

Point-in-time recovery

Daily full and 6-hourly differential backups, plus continuous log archiving, so data can be restored to a chosen moment.

Tested restores

Every quarter we restore a backup into an isolated environment and record the result.

Durable file storage

Files sit in Amazon S3, designed for 99.999999999% durability across multiple facilities.

Incident response and disclosure

If something goes wrong, a defined process takes over, and you hear from us within 72 hours of a confirmed incident that affects your data.

1
Detect and triage
Severity is rated P1 to P4 and an incident lead is named.
2
Contain
Affected systems are isolated, exposed credentials revoked and malicious traffic blocked.
3
Recover
The root cause is fixed, clean backups are restored if needed, and integrity is verified.
4
Notify
Affected customers hear from us within 72 hours of confirmation. CERT-In is notified within 6 hours, as Indian law requires.
5
Learn
A written post-incident review within 5 working days, with every corrective action tracked to closure.

Found a vulnerability?

Email [email protected] with the steps to reproduce it. We acknowledge every report within 48 hours, assess it within 7 days, credit researchers who want credit, and never take legal action against good-faith research.

Report securely

Compliance and certifications

Vacademy's security programme is independently certified and built around the laws and standards that apply to education data in India.

ISO/IEC 27001

Certified information security management system. Certificate available on request.

ISO 9001

Certified quality management system.

DPDP Act, 2023

Personal data is processed as India's Digital Personal Data Protection Act requires.

IT Act and CERT-In Directions

Incident reporting and log retention follow the Information Technology Act, 2000 and the CERT-In Directions of April 2022.

OWASP Top 10 and ASVS

Application security is designed and tested against OWASP standards.

SOC 2

In progress.

Infrastructure sub-processors
Provider	Purpose	Certifications
Amazon Web Services	File storage, content delivery, transactional email	ISO 27001, SOC 1/2/3
Hetzner Online	Application and database hosting	ISO/IEC 27001
Cloudflare	DNS, TLS, DDoS protection, web application firewall	ISO 27001, SOC 2 Type II
Sentry	Application error monitoring	ISO 27001, SOC 2 Type II

Messaging, payment and AI providers process data only for the features you switch on. The full list is in our security pack.

People and physical security

Confidentiality and acceptable-use agreements signed before any access is granted
Background verification for everyone with production access
Security awareness training at onboarding and every year
Multi-factor authentication on every cloud, code and admin console
Encrypted, auto-locking, protected work devices
Quarterly review of all privileged access; same-day removal when people leave

Servers live in our providers' certified data centres, with 24x7 guards, controlled entry, CCTV and redundant power.

Security questions buyers ask us

Is Vacademy ISO 27001 certified?

Yes. Vacademy runs an ISO/IEC 27001 certified information security management system, and is also ISO 9001 certified. We share the certificates with customers and their auditors on request.

Where is our institute's data stored?

By default, on Vacademy's cloud with Hetzner Cloud and Amazon Web Services, fronted by Cloudflare. If you need data kept in a particular country, including India-only hosting, we run a dedicated deployment in the region you choose.

Who at Vacademy can see our data?

Only a small number of named engineers, for operations and support, using multi-factor authentication and least-privilege access. They open customer data only to resolve a support request you raised or with your documented consent, and every access is logged.

Does Vacademy support SSO and SAML?

Yes. Staff and learners can sign in with Google, Apple or GitHub, and each institute can show its own branded Google sign-in screen. SAML 2.0 with providers such as Okta and Microsoft Entra ID is available on request.

How is our data encrypted?

All traffic uses TLS 1.2 or higher. Files are stored with AES-256 encryption, backups are AES-256 encrypted, sensitive fields get an extra layer of AES-GCM encryption, and passwords are stored only as bcrypt hashes.

What happens if there is a security incident?

We contain it, fix the root cause and notify affected customers within 72 hours of confirming it. Reportable incidents go to CERT-In within 6 hours, as Indian law requires. A written post-incident review follows within 5 working days.

Do you run penetration tests?

Yes. An independent CERT-In empanelled auditor tests the web applications, mobile apps and external network every year and before major releases. Automated security scans also run on every code change. We share the test summary under NDA.

Is our data used to train AI models?

No. Your data is used only to provide the service to you. AI features are switched on per institute, and the AI providers we use process data under terms that do not allow training on it.