04 / Backup and archival

Long-term backup and archival

An institution's records outlive every system that created them. A graduate from 1995 still needs a verified transcript; a court may ask for an answer script years after the result; a ransomware attack can encrypt a decade of records in an afternoon.

We design and run backup and archival so that your records survive hardware failure, human error, attacks and the passage of time. Backups are immutable, archives are indexed and readable, and recovery is tested on a schedule rather than assumed.

The problem we solve

Many campuses rely on a single backup drive in the same server room, or on a cloud copy that ransomware can encrypt along with the original. Degree registers from earlier decades exist only on paper, kept in a storeroom with leaking pipes. Answer scripts are either kept forever because nobody decided otherwise, or destroyed before the period in which students can still ask to see them. When a verification request arrives for an old graduate, someone spends half a day in the record room. And nobody has ever tried to restore the whole system from backup, so nobody knows whether it works.

What you have at the end

  • Backups on the 3-2-1 rule, with at least one copy immutable and isolated from the network
  • A permanent, searchable archive of every degree, transcript and result your institution has issued
  • A written retention schedule for answer scripts and other records, approved by your academic council
  • A tested ransomware recovery plan with measured recovery times
  • Legacy paper registers digitised, indexed and verifiable
  • Certificates issued with e-signatures that can be verified without calling the registrar

Scope of service

01

Immutable (WORM) backups following the 3-2-1 rule

We keep at least three copies of your data, on two different types of storage, with one copy off-site, and make at least one copy write-once-read-many so it cannot be altered or deleted, even by an administrator with stolen credentials. Backups are encrypted, monitored and stored in India. You get a daily report showing what was backed up and whether it succeeded.

Deliverables

  • Backup design covering every system and database you rely on
  • Immutable (WORM) copy with a defined retention lock
  • Off-site copy in a separate Indian location
  • Daily backup success report and alerts on failure
02

Permanent archive of degrees and transcripts

Degrees, provisional certificates, transcripts and result ledgers are records you must be able to produce for as long as your alumni live. We build a permanent archive in open, durable formats, indexed by student, programme and year, with integrity checks that detect any change. Verification requests can then be answered in minutes, and the archive is pushed to DigiLocker/NAD where applicable.

Deliverables

  • Archive in open formats with fixity (integrity) checks
  • Search by name, enrolment number, programme and year
  • Verification request workflow with a logged response
  • Periodic format and media refresh plan so files remain readable
03

Retention schedules for answer scripts

How long to keep answer scripts is set by your university statutes or ordinances, examination regulations and court orders, and students may seek access to their evaluated scripts under the RTI Act where it applies. We draft a retention schedule that respects those obligations, then make sure scripts are kept for exactly that period and disposed of securely afterwards with a record of destruction. Scanned scripts from on-screen evaluation follow the same schedule.

Deliverables

  • Draft retention schedule for physical and scanned answer scripts
  • Mapping to your statutes, examination regulations and RTI obligations
  • Automated retention and disposal for digital scripts
  • Secure destruction records for physical scripts
04

Ransomware recovery drills

A backup is only proven when it has been restored. We run scheduled recovery drills, from restoring a single file to rebuilding a full system in an isolated environment, and measure how long each takes against your targets. Each drill ends with a written report and a list of fixes, and the playbook ties into your CERT-In six-hour reporting path.

Deliverables

  • Ransomware recovery playbook linked to the incident response plan
  • Recovery drills with measured restore times. The standard frequency is set in the contract, not on this page.
  • Isolated recovery environment for testing
  • Drill report with findings and corrective actions
05

Digitisation of legacy registers

Old tabulation registers, result ledgers and admission books are often the only proof of a degree issued decades ago. We scan them at archival quality, extract the key fields, have them checked by your staff and link them to the archive. The originals are returned and catalogued, never discarded without your written instruction.

Deliverables

  • Digitisation plan and handling protocol for fragile registers
  • Archival-quality scans with metadata
  • Key fields extracted and verified by your staff
  • Catalogue of originals and their storage location
06

E-signed certificates and retention-policy design

We set up degree and certificate issuance with digital signatures valid under the Information Technology Act, 2000, using signing certificates from licensed providers, so a certificate can be verified as authentic and unaltered. Alongside, we design your institution-wide retention policy: which records you keep, for how long, in what form and who may destroy them. The policy is drafted for approval by your statutory bodies.

Deliverables

  • Digital signing set-up for degrees, transcripts and certificates
  • Public verification method for issued documents
  • Institution-wide records retention policy (draft for approval)
  • Annual retention compliance review

How an engagement runs

  1. 01

    Inventory and risk

    We list every record type you hold, physical and digital, where it lives, how it is backed up today and what the law or your statutes say about keeping it.

  2. 02

    Design

    Backup architecture, archive structure and the retention schedule are drafted together, with recovery targets agreed for each system.

  3. 03

    Implement and digitise

    Immutable backups go live first because they reduce risk fastest. Archive building and digitisation of legacy registers follow in planned batches.

  4. 04

    Prove it

    The first full recovery drill runs before we call the project complete, and its report goes to your leadership.

  5. 05

    Operate

    We run backups, archive intake and drills on schedule, with a monthly report and an annual retention review.

Who this is for

Regulations covered

Questions, answered

We already back up to the cloud. Is that not enough?

It may not be. If the cloud copy is reachable with the same credentials as your live systems, ransomware or a compromised admin account can encrypt or delete it too. An immutable copy, isolated from your network and locked against changes, is what protects you. We check what you have before recommending anything new.

What does 'Archived 25Y' mean?

It is our shorthand for records designed to be kept and readable for decades, not a fixed limit. Degrees and transcripts are archived permanently; other records follow the retention period in your approved schedule.

How long must we keep answer scripts?

There is no single national rule. The period is set by your university statutes, examination regulations, pending litigation and RTI access rights where the Act applies. We draft a schedule that respects all of them and have it approved by your academic council or equivalent body.

Does the DPDP Act conflict with keeping records forever?

The Act expects personal data to be erased once its purpose is served, unless retention is required by law. Degree and result records have a lasting legitimate purpose, but marketing leads and some application data do not. The retention policy draws that line clearly so you keep what you must and erase what you should.

Will you take away our original paper registers?

No. Scanning is done under a handling protocol you approve, on your premises where possible, and originals are returned and catalogued. Nothing physical is destroyed without your written instruction.

Book a free compliance and infrastructure audit.

A senior consultant reviews your data, systems and regulatory position with your team and gives you a written gap report. There is no cost and no obligation to buy anything.

A senior consultant reviews your data, systems and regulatory position with your team and gives you a written gap report, at no cost.