Compliance-as-a-Service on a sovereign cloud

Each institution gets its own isolated environment: a dedicated tenant or virtual private cloud with its own encryption keys, access controls and network boundaries. Data is hosted in Indian data centres, which meets the CERT-In log-localisation requirement and any contractual or sectoral residency obligation you carry. Where you choose to keep some data elsewhere, the map of what sits where is written down and approved. Facility names and the hosting model are not published on this page.

We build the DPDP Act 2023 and DPDP Rules 2025 into your systems: clear notices, consent capture and withdrawal, a consent management workflow, and verifiable consent from a parent or guardian before processing a child's data, where 'child' means anyone under 18. We set up the process to inform affected students and the Data Protection Board of India of a personal data breach without delay, and to send the Board the detailed report within 72 hours, as Rule 7 requires. We also handle data-principal requests for access, correction and erasure, and flag where the Rules give educational institutions limited exemptions. The Rules were notified on 13 November 2025, and most duties of data fiduciaries apply from 13 May 2027. Later commencement changes are not described on this page.

Under the CERT-In Directions of 28 April 2022, notified cyber incidents must be reported to CERT-In within six hours of being noticed, and ICT system logs must be maintained for a rolling 180 days within Indian jurisdiction. We collect and retain the logs, synchronise clocks to the national time sources, monitor for incidents and run the reporting path with your designated point of contact. If something happens at 2 a.m., the clock is already running and our team is already on it.

For institutions running or planning Open and Distance Learning or Online programmes, we keep the platform and records aligned with the UGC (Open and Distance Learning Programmes and Online Programmes) Regulations, 2020, as amended. That covers the records UGC expects for admissions, learner support, proctored examinations and disclosures on your website. Entitlement criteria and conditions change with amendments, so we check them against the current notified text before every application. Numeric thresholds are not published on this page.

AISHE, NIRF and NAAC ask for many of the same figures: students, faculty, programmes, finances, results and placements. We hold those figures once, in a validated data set, and generate each submission from it, so your numbers match across all three. For NAAC, that covers the Self Study Report, the Annual Quality Assurance Report and responses to Data Validation and Verification queries, with the evidence documents linked. A person on your side still reviews and submits each return; we prepare it.

The service is designed to connect your student record to the Academic Bank of Credits, APAAR IDs and DigiLocker/NAD, so credits, results and certificates can reach students through the national systems as part of your normal result process. Mismatches between your record and the national registry are reported, not discovered by a student years later. Our integration route and onboarding status are not stated on this page.

Every create, change and delete on a student, staff, exam or financial record is logged with who, when and what changed, and the log itself cannot be edited. For institutions covered by the Right to Information Act, records are indexed so a request can be answered within the statutory time. The same trail answers auditors, regulators and courts.