Security & privacy
Schools trust us with fees and with children’s records. These protections are on every plan, including the free trial — never an upsell.
Each school is walled off
Every table that holds school data carries the school it belongs to, and the database itself enforces it: a request made for one school can only ever read and write that school’s rows. This is row-level security in PostgreSQL, applied below the application, so a mistake in a screen cannot leak another school’s data.
Signing in
- Passwords are hashed with Argon2id; sign-in codes expire in minutes and lock after repeated failures.
- Two-factor sign-in with an authenticator app, and passkeys, on every plan.
- Each school sets its own sign-in policy — for example, requiring a second factor for anyone who handles money.
- Every sign-in is recorded with its device, so you can see who was in and sign out a lost phone.
Who can do what
Roles decide what each person can see and change, down to their own class or their own children. Moving money is kept apart from administering the school: the person who approves a fee waiver is not automatically the person who collects fees. The account owner decides who can change the plan or pay for it.
Sensitive data is sealed
Data travels over HTTPS only. Bank accounts, identity numbers and payment-gateway keys are additionally encrypted with their own keys before they are stored, so they stay unreadable even to someone holding a copy of the database.
An audit trail of every change
Changes to fees, concessions, marks, roles and settings record who made them and when. Approvals keep their full history.
Your data under the DPDP Act
Your school is the data fiduciary for student and parent data; Camponia is your data processor and signs a Data Processing Agreement with you. We process data only to run the service for you, keep it in India, and help you answer requests from parents. Consent tools for families are built in.
Payments
Parents pay your school through your own payment-gateway account; the money settles in your bank account and never passes through Camponia. Card and UPI details are handled by the gateway — they never touch our servers.
Telling us about a problem
If you believe you have found a security issue, write to [email protected]. We acknowledge reports within two working days. For anything else, [email protected].