Data protection

Your institution decides what personal data goes into its account and why, which makes it responsible for that data. MageBytes Pvt Ltd processes the data on the institution's behalf, only to provide the service.

Every record belongs to one organization, and access is enforced in the server's API layer rather than only hidden in the interface. Within an organization, a branch administrator can see only their own branch. Faculty, students and guardians each get a purpose-built view limited to what they are responsible for.

• Six roles: superadmin (platform operator), organization admin, branch admin, faculty, student and guardian.
• New staff, students and guardians are approved by an administrator before they can use the account.
• Optional modules are switched on per institution, and requests to a module that is switched off are rejected by the server.
• A guardian can see only the children they are linked to.

• Passwords are hashed with bcrypt and never stored in readable form.
• Sessions use a signed token in an httpOnly cookie, which page scripts cannot read.
• Login, sign-up, password reset and the website contact form are rate-limited per IP address to slow brute-force attempts and spam.
• Password-reset links are single-use, time-limited, and the response does not reveal whether an email address has an account.
• A strict Content-Security-Policy and other security headers restrict where scripts, styles, frames and connections can come from.
• Online payments run on Razorpay's hosted checkout. Each payment confirmation is signature-verified and a repeated confirmation cannot be applied twice.
• Connections use HTTPS, with a Strict-Transport-Security header.

Sensitive actions, such as approvals, fee payments, password changes, account deletion and certificate issue or revocation, are written to an audit log that organization administrators can view.

• Export: any signed-in user can download the data held against their own account.
• Deletion: any user can delete their own account after confirming their password. Name, email and phone are replaced with anonymous placeholders and login is blocked. Records others rely on, such as fee records, enrolments and certificates, are retained so they stay accurate and verifiable.
• Certificate verification: anyone who has a certificate number can check it on a public page, which shows the holder's name, program, cohort, issue date and whether it is valid or revoked. Nothing else about the person is shown.

• Razorpay: online fee payments. Card and UPI details do not reach our servers.
• Twilio: SMS and WhatsApp delivery.
• SendGrid: email delivery.
• LiveKit, Daily or Zoom: live class audio and video, depending on the institution's configuration. Institutions can use their own Zoom or Daily account.
• Hosting and infrastructure providers: storage and serving of the application and database.

Ask us about hosting location and any other due-diligence questions your institution has.

If we become aware of a personal data breach affecting an institution's data, we will tell that institution without undue delay so it can meet its own obligations.

Data protection questions, or to request a due-diligence conversation: info@magebytes.com.