Security & data
Scoped to one campus — and not as a promise.
A campus administrator's access comes from a single database row naming exactly one college. Every query the console makes is filtered by that column, every privileged write is re-checked, and every one of them is written to a log your own staff can read.
Sessions you can revoke
The browser holds an opaque random token; the database holds only its SHA-256 digest. Suspending an account ends every one of its sessions immediately, not at the next expiry.
Passwords hashed with scrypt
Salted per user, with the cost parameters stored alongside each hash so they can be raised without a migration. Plaintext passwords are never written anywhere, including logs.
Authorisation on every write
Server actions are public endpoints, so each one re-checks permission itself rather than trusting the page that rendered the button. A campus permission names exactly one college.
An append-only audit log
Every privileged change — a campus edited, a student verified, a role granted — is recorded with the actor, the campus and a before/after. The application writes it; nothing updates it.
Data stays in India
Primary and backup storage are in the ap-south region. Nothing about your campus is replicated outside the country without a written agreement.
Export whenever you want
A campus head can export their college's data as SQL or CSV at any time, without asking us. Leaving is a decision you can make on a Tuesday afternoon.
Who can see what
The whole access model, in one table.
If a row here surprises you, write to us — this is the thing we would most like to be wrong about in public.
In the code
Four things we do not leave to discipline.
Security that depends on every developer remembering it will eventually be forgotten. These are enforced in one place each.
Authorisation is re-checked on every write
Server actions are reachable as plain POST requests, so each one re-asserts permission itself rather than trusting the page that rendered the button. A campus permission names exactly one college; a mismatch throws before anything is written.
Reads are scoped by construction
Every campus query takes a college id as a parameter — there is no “fetch all students” call for a campus administrator to reach. The platform-wide queries live in a single file that only the super admin console imports.
Suspension is immediate
Changing an account to suspended revokes every one of its live sessions in the same transaction. It does not wait for a token to expire.
Secrets never reach a log
Passwords are hashed before they leave the request handler, session tokens are hashed before they are stored, and neither is written to application logs or error traces.
Responsible disclosure
Found something? Tell us, and we will not make you regret it.
We do not run a paid bounty programme yet. We do read every report, reply to every one, and credit anyone who wants it.
- Report
- security@remotecampus.app, with enough detail to reproduce it.
- Acknowledge
- Within one working day, from a person, not an autoresponder.
- Fix
- Critical issues inside seven days; everything else with a date we tell you.
- Credit
- Named in the release note if you want to be, and never legal action for reporting in good faith.
What we do not have yet
We are not SOC 2 or ISO 27001 certified, and we are not going to imply otherwise on a marketing page. There is no third-party penetration test report to hand you yet either. If either is a requirement for your institution, say so early and we will tell you honestly where we are rather than where we intend to be.
Questions
Send the security questionnaire.
We would rather answer it properly once than hedge on a web page. Attach it and we will fill it in.