Data protection & privacy
Privacy is not a bolt-on. Verifiable parental consent for minors, lawful-basis purpose tagging, data-principal rights with SLA clocks, and a dual-clock breach response - and student data is never sent to, or used to train, a third-party AI model.
See it live
Watch the real flow run
Built for the DPDP Act. Student data never trains an AI.
The payoff
Outcomes, not features
Start to finish
Inside data protection & privacy
The real end-to-end flow - from the school's first action to the audited, reason-coded outcome.
- 1Tag every purpose with a lawful basisNothing is processed on a vague blanket consent. Each purpose is bound to one of five DPDP lawful-basis tiers (statutory obligation, core-service, optional, voluntary, and safety), so a school can prove exactly WHY it holds each field. The two true consent tiers only turn on once a verified, unexpired consent record exists; the notice-only bases proceed but are still logged.
- 2Verify the parent for anything about a minorUnder-18 records trigger the Section 9 child guardrail. Processing is decided purpose-aware: a Fourth-Schedule child-interest purpose (attendance, assessment, health, child-safety) proceeds, a prohibited activity like behavioural tracking is blocked, and everything else falls back to full verifiable parental consent, backed by a signed DigiLocker age-token (DPDP Rule 10) rather than a self-declared checkbox.
- 3Encrypt the sensitive fields and log the accessAadhaar and other sensitive fields are held under AES-256-GCM field-level encryption, never as plaintext. Every read of a protected record is written to an append-only, tamper-evident audit trail (per-tenant sequence plus a keyed hash-chain), so who-saw-what is provable after the fact and cannot be quietly rewritten.
- 4Honour rights on a clock, and answer a breach on twoData-principal requests (access, correction, erasure) run on a configurable 30-day service target with a hard 90-day grievance ceiling. Erasure is a genuine crypto-erase: destroy the key and the ciphertext is unrecoverable forever. A reportable breach starts a dual clock at once, a 6-hour CERT-In technical report and a 72-hour Data Protection Board report, each tracked to its deadline.
The building blocks
The modules that do the work
The 4 modules that make up data protection & privacy.
Consent & privacy
Lawful-basis tiers, verifiable consent, Rule-3 notice.
Consent verification
Adult / age verification, DigiLocker-ready.
Sensitive data
Field-level encryption and governance.
Security audit
Append-only, tamper-evident audit trails.
Signature automations
What most systems don't do
Built-in mechanics you won't find elsewhere - running in the product, not drawn on a slide.
Five lawful-basis tiers with a purpose-aware child guardrail
Consent is not one on/off switch. Five explicit DPDP bases classify every purpose, and processing of a minor is decided per-purpose under Section 9(3): exempt child-interest purposes proceed, prohibited activities (tracking, behavioural monitoring, profiling, targeted advertising) are blocked, and anything else requires verifiable parental consent. Fail-safe: an unparseable date of birth is treated as a child.
Verifiable parental consent via a signed DigiLocker age-token
DPDP Rule 10 wants VERIFIABLE consent, not a checkbox. Vidyom verifies a signed, expiring DigiLocker age-token before writing gold-tier parental evidence. The token payload carries only an opaque pairwise subject reference and an adult boolean, never a name or DOB, and the raw token and secret are never logged. Off the live credential it fails closed rather than trusting the public dev stub.
AES-256-GCM field encryption with a true crypto-erase
Sensitive fields are sealed with AES-256-GCM, and erasure is not a soft delete. Destroying the per-record key makes the ciphertext fail its GCM auth tag forever, an unrecoverable NIST SP 800-88 crypto-erase that satisfies the DPDP right-to-erasure for one token or an entire subject vault, with no plaintext fallback on a decrypt failure.
Tamper-evident audit chain: keyed hash-chain, Merkle head, external witness
Access logs are not merely append-only by privilege; each row folds a keyed HMAC-SHA256 hash-chain (prev-hash to row-hash) over a canonical payload, so a privileged insider who mutates or deletes a middle row is caught on verify. A Merkle tree head can be published to an independent external witness to catch tail-truncation too, wired flag-off with an honest no-egress stub until a live timestamping service is configured.
Also built in
More in data protection & privacy
Capabilities that already ship in the product - each shown live, not just named.
Access governance
Custom roles, recertified & dual-controlled
Build your school's own roles by toggling per-module viewer, editor and admin access. Recertify who holds each role on a schedule, and require two-person approval before any sensitive money action goes through. Every grant is server-enforced and audited.
- Compose a role like "Accountant" from per-module permission toggles
- Periodic access recertification with a signed, dated stamp
- Dual-control: 2-of-2 approval for Fees & Payroll writes
POCSO Section-23
A protected child’s identity is redacted in every view
Flag a child victim as confidential once, and their name, photo and contact are automatically masked across every screen, list, report and export — the identity can never quietly re-surface.
- One canonical redaction choke-point — fail-closed, so an unclassified record is never leaked by accident
- A reveal needs the explicit
pocso:revealcapability plus step-up re-auth - Every reveal is a logged break-glass, then the record re-seals to redacted
Straight answers
Data protection & privacy - common questions
Is student data ever sent to an AI model?
No. Student PII is never sent to, or used to train, any third-party model. The AI-assist paths are deterministic templates by default, and a runtime guard refuses any prompt that even carries a name-like or contact field key. The privacy posture and the intelligence posture are the same promise.
When a parent asks you to delete a child, is it really gone?
Yes, and provably. Encrypted fields are crypto-erased by destroying the key, which permanently breaks decryption of the ciphertext, and the request runs on a 30-day target with a 90-day grievance ceiling. It is a real erasure, not a hidden flag.
What actually happens in a data breach?
A dual clock starts immediately: a 6-hour CERT-In technical report and a 72-hour Data Protection Board report, each tracked to its own deadline so neither statutory window is missed. The obligation is durable, so a crash between raising and reporting is reaped rather than dropped.