Security at Shikshel
Student records are among the most sensitive information a school holds. Here is exactly how we protect them.
Last updated: 2 August 2026
Student data is stored in India
Shikshel's production database and file storage run on Supabase, hosted on Amazon Web Services in the Mumbai (ap-south-1)region. Your school's records — students, staff, fees, attendance, academics — are stored in India.
Some supporting services run on global infrastructure: application hosting, email delivery, and DNS. Those handle requests and messages in transit; they are not where your records live. All of them are listed below.
Encryption
- In transit: all traffic is encrypted with TLS (HTTPS).
- At rest: the database and stored files are encrypted with AES-256 on AWS.
Each school is isolated at the database level
Shikshel is multi-tenant, and every school is separated using PostgreSQL Row-Level Security (RLS). This is enforced by the database itself, not by application code:
- No school can read or write another school's data.
- Every query is scoped to the school it belongs to, at the database layer — so a bug in the interface cannot expose another school's records.
- Within a school, staff see only what their role allows: teachers, office staff, parents, and students each get their own view.
AI never trains on student data
Student information is never used to train AI models. Shikshel's AI features work on your school's data to produce a result for your school, and nothing more.
Teachers stay in control: AI assists with lesson planning, drafting, and flagging trends, but academic decisions remain with the people who make them today. Nothing is published to parents or students on a teacher's behalf without review.
Backups
The production database is backed up daily so records can be restored in the event of an incident, and runs on AWS's highly available infrastructure.
Sub-processors
We rely on a small set of established providers to operate the platform:
- Supabase / AWS (Mumbai) — Database, authentication, and file storage
- Vercel — Application hosting and delivery
- Resend — Transactional email delivery
- Cloudflare — DNS and routing for our contact address
Compliance
We build to align with India's Digital Personal Data Protection (DPDP) Act, 2023. Our infrastructure providers maintain certifications such as SOC 2 and ISO 27001, which Shikshel inherits at the infrastructure layer. Those certifications belong to those providers; Shikshel does not currently hold independent certification of its own.
Incident response
If a security incident affects your school's data, we will investigate promptly and notify you without undue delay, along with what we are doing about it.
Reporting a vulnerability
Found a security issue, or have a question this page does not answer? Email contact@shikshel.com and we will take it seriously.
Want to go deeper?
We are happy to walk your IT team or management committee through any of this in detail.