Enterprise-Grade Security for Student Data
Student data is our most critical responsibility. Every layer of Alfanumrik is designed with defense-in-depth security principles.
Secure Cloud Architecture
Built on battle-tested infrastructure with encryption at every layer.
Managed Data Store
Managed, access-controlled storage with per-user policies on every record. Live updates with policy enforcement.
Mumbai Region
Primary data storage and services deployed in the Mumbai cloud region for low-latency access across India.
Encrypted at Rest & In Transit
Database storage is encrypted at rest by our cloud provider. All traffic to the platform uses HTTPS.
Identity & Session Security
Modern authentication standards with server-side enforcement.
HttpOnly Session Cookie
Sign-in uses email and password, hashed with argon2id. The session lives in an HttpOnly, SameSite=Lax cookie, Secure over HTTPS, so page scripts cannot read it. State-changing requests must come from the app's own origin.
Server-Side Sessions
Each session is held on the server with an idle expiry and an absolute expiry. Signing out ends this session or, if you choose, all of them.
Server-Side Session Validation
All sensitive operations validate sessions server-side. No client-side-only authentication checks for protected resources.
Role-Based Access Control
Role-Based Access Control with separate student, parent and staff roles, each with its own granular permissions.
Multi-Layer Data Security
Defense-in-depth data protection from the database to the API to the UI.
Per-User Data Isolation
Access policies on every data store ensure users can only access their own data. Enforced at the storage level, not application level.
Audit Logging
All admin actions, data access events, and configuration changes are logged with timestamps, actor IDs, and action details.
DPDPA Compliance
Full compliance with the Digital Personal Data Protection Act, 2023 — consent management, data principal rights, and grievance redressal.
Principle of Least Privilege
Every user sees only what they need. Every request is verified.
Role-Based Access
Strict role separation: students, parents, and staff each see only what they need. No role escalation possible.
Resource-Level Ownership
Every resource has an owner. Ownership is checked on every read, write, and delete operation at both API and database levels.
Layered Rate Limiting
Distributed, low-latency rate limiting protects against abuse. Per-user, per-feature, and global rate limits with sliding windows.
Attempt Throttling
Sign-up, login, and password-reset requests are throttled per IP and per account to bound automated abuse and credential-guessing attempts.
Securing the AI Layer
AI-specific security measures to protect against emerging threats.
Prompt Injection Prevention
Multi-layer input sanitization and system prompt hardening prevent prompt injection attacks against Foxy.
Content Moderation
All AI outputs pass through content filters for age-appropriateness, accuracy, and safety before reaching students.
XP Manipulation Prevention
Server-side validation of all XP awards, streak calculations, and leaderboard entries. No client-side trust for gamification.
Session Isolation
Each Foxy session is isolated. No cross-session data leakage between students. Conversation history is per-user and encrypted.
Independently Verified
Our security practices are validated against international standards.
Extra Safeguards for Young Learners
Protections that apply to every student on the platform.
Parental Consent for Linked Children
A parent can read a linked minor's learning data only after recording that parent's own consent under the current policy, checked on every read. A parent who creates the child's account records consent in that step. Students under 13 cannot sign up alone: a parent creates their account. A student aged 13 or over who signs up alone does not yet go through a parental consent step.
Data Minimization
We collect only the minimum data necessary for the learning experience. No unnecessary profiling or behavioral tracking.
No Ads, No Data Selling
Alfanumrik will never show advertisements to students or sell student data to any third party, period.
When Things Go Wrong
Transparent, rapid response protocols for security incidents.
24-Hour Disclosure
Any confirmed data breach affecting student data will be disclosed to affected users and relevant authorities within 24 hours.
Structured Error Reporting
Logs are redacted automatically: passwords, tokens and email addresses are removed before anything is written.
Audit Trail
Staff actions and consent decisions are written to an append-only record.
For security concerns or to report a vulnerability, contact our security team at security@alfanumrik.com.