Isolation between schools
Each school's data sits in its own isolated space. Every request is routed to exactly one school, and isolation is tested automatically before each release — so one school can never see another's students or payments.
Trust & security
Parents trust you with their children. You can trust us with their data.
Security isn't a feature we added to SMARA. It's how the platform is built — tested automatically on every change before it reaches your school.
Multi-factor authentication
Standard authenticator-app MFA (Google Authenticator, Microsoft Authenticator, Authy). Secrets are encrypted before storage, ten one-time recovery codes are issued, and MFA can be made mandatory.
Least-privilege roles
A permission matrix governs every route. Teachers see their assigned classes; parents see only their own children.
Tamper-evident receipts
Receipt codes carry no personal data. Any change to a payment invalidates the old code automatically.
Private wellbeing records
Mood check-ins use a hashed student identifier and contain no personal data. Only counsellors can link a case to a name.
An AI assistant with guard rails, not guesswork
Questions pass through a prompt-injection guard and a permission check before any data is read. Only the data that role is allowed to see is fetched, personal details are stripped, and every query is logged. Aadhaar numbers, contact numbers, home addresses and staff salaries are never sent to an external AI model.
At a glance
How we handle what matters.
| Area | What SMARA does | Why it matters to your school |
|---|---|---|
| Hosting | Runs on Amazon Web Services in India. | Student data stays in the country. |
| Backups | Automated nightly export of every school's data. | Recover quickly from mistakes or incidents. |
| Personal data | Designed with India's Digital Personal Data Protection Act, 2023 in mind; wellbeing data minimised by default. | Easier conversations with parents and your board. |
| Access | Role-based permissions on every route, MFA, forced password change on first login. | The right people see the right records — nobody else. |
| Mobile apps | Tokens in secure device storage, refresh-token rotation, forced upgrades for outdated versions. | A lost phone doesn't become a data leak. |
| Financial records | Verifiable receipt codes bound to a fingerprint of the saved payment. | Forged or altered receipts are caught at the counter. |
| Releases | Isolation, permission and calculation tests run automatically before every deployment. | Updates don't break what already works. |
Need our security questionnaire or a data-processing agreement for your management committee? Request it here.