How we protect your school's data, user accounts, and communications across every layer of the platform.
Checked Sign-In
Every signed-in request is checked against the user's current account status, school status and role. Repeated wrong passwords lock the account for 15 minutes.
Role-Based Access
Seven roles - Super Admin, Principal, Teacher, Admissions Officer, Finance Officer, Transport Manager and Parent - each limited to the work it is meant for.
Encrypted at Rest & In Transit
All traffic uses HTTPS (encrypted connections). Stored data is encrypted with AES-256, provided by our database provider, Supabase.
Activity Trail
Important actions are logged with who did it, what changed and when. Entries cannot be edited by users, and Super Admins can export them.
ZenCampus uses Supabase Auth for sign-in. Users sign in with a login ID and password issued by their school. After a successful sign-in, the app receives a signed sign-in token that is sent with every request.
Passwords are never stored in plain text. They are hashed (scrambled one way) before they are saved, and we cannot see your password at any point.
Access within ZenCampus is governed by a role-based model. A user holds exactly one role at a time and cannot raise their own role. Staff accounts and role changes can be made only by the school's Super Admin. Parent accounts can also be created by a Principal or Admissions Officer when they add a student. Each role is limited to the work it is meant for. Most staff roles are also scoped to the campuses they are assigned to, so a user with no campus assignment sees no data rather than defaulting to full access. Students are managed as data entities within the system; they do not hold user accounts.
| Role | Scope |
|---|---|
| Super Admin | Full access across every campus. Manages users, settings, billing, academic years, fee configuration, announcements, and all data. |
| Principal | Full admin access, but limited to the campus or campuses they are assigned to. Blind to other campuses in the same school. |
| Teacher | Works with the classes they are assigned to: marks attendance, enters grades, sets homework, views the timetable and applies for leave. |
| Admissions Officer | Student records (create, edit, archive, graduate, suspend) and the admissions enquiry pipeline, up to an offer. Cannot convert an enquiry into a student account or change seats and quotas. |
| Finance Officer | The finance module - payments, waivers, refunds, reminders, and fee configuration - plus read-only access to the admissions pipeline where fees are collected at intake. |
| Transport Manager | Vehicles, routes, student transport allocations, trips and incidents for the campuses they are assigned to. No access to admissions, fees or staff records. |
| Parent | Sees only their own linked children: attendance, published grades, homework, fees, announcements and the school calendar. Can pay fees, submit homework, book parent-teacher meetings and request certificates for their own children. Cannot change school records. |
All schools share one database, and every record carries its school's ID. Every server request is tied to the signed-in user's school, and every query is limited to that school. Database row-level security also blocks direct reads of another school's data.
ZenCampus sets a limit on how many accounts of each role a school can have. The school cannot raise these limits itself. This means a stolen admin login cannot be used to create accounts in bulk: attempts beyond the limit are blocked and reported to us.
Authorised ZenCampus staff can sign in to a school's account, export its data, or reset its Super Admin's password, to provide support or keep the service secure. Each staff sign-in is recorded in our platform log with the staff member and the time.
A Super Admin can force a user to sign in again. Our servers then refuse that user's earlier sessions.
All data stored in the ZenCampus database - including student records, attendance data, fee information, academic grades, and personal details - is encrypted at rest using AES-256. This encryption is provided by our database provider, Supabase.
All traffic uses HTTPS (encrypted connections).
Each school's WhatsApp access token is stored encrypted (AES-256) and is never shown again after it is saved. The same applies to each school's Razorpay key and payment notification (webhook) secrets.
Uploaded files are kept in private storage and opened through links that expire after 5 minutes. Each upload's type is checked by its actual content, not just its name. Only images and PDFs are accepted, up to 5-10 MB per file depending on your plan.
All ZenCampus API endpoints are protected by a layered middleware stack that runs before any business logic is executed:
Authorization headerDatabase queries pass values as parameters, and search text is cleaned before it is used in a filter.
ZenCampus keeps an audit log of important actions, such as sign-ins, user and role changes, fee payments, refunds and waivers, student record changes, exports, and more. The audit trail is available to Super Admins from the Audit Log section of the dashboard.
Each log entry records:
Log entries cannot be edited by users. They are kept for your plan's retention period (up to 1 year on Essential and Plus, up to 2 years on Complete and Enterprise; a Super Admin can choose a shorter period, at least 7 days) and then removed. Super Admins can export the log as a CSV file.
The application runs on Cloudflare's network. Data is stored with Supabase.
Super Admins can download a copy of the school's records. Full archives are available on Plus and above. A request to delete the school's data needs a completed export first, and the deletion is carried out by ZenCampus.
We notify affected schools within 72 hours of confirming a breach that affects their data.
ZenCampus does not operate its own physical data centres. All infrastructure security obligations - including physical security, hardware maintenance, and network-level DDoS mitigation - are handled by our hosting and database providers.
Online fee payments are processed through Razorpay, an RBI-authorised payment gateway. Each school uses its own Razorpay account, so money goes straight to the school. Card, UPI and bank details are entered on Razorpay's own pages. From each payment we keep the payment reference, status, amount and method type (UPI, card and so on). We never store card numbers, CVV or bank account numbers.
ZenCampus uses Sentry to find and fix technical problems. Error reports are scrubbed of names, emails, phone numbers and addresses in labelled fields, and request bodies and cookies are removed. They may include internal account IDs and the school ID. Sentry stores this data in the EU.
ZenCampus integrates with the WhatsApp Business API to deliver attendance alerts and school announcements to parents. This integration is built with the following security controls:
We welcome responsible disclosure of security vulnerabilities. If you discover a security issue in ZenCampus, please report it to us before public disclosure so we can investigate and remediate the issue.
For security-related questions or to report a vulnerability:
Found a security issue?
Report it responsibly and we'll respond within 2 business days.
Report a Vulnerability