Institutional security designed for student privacy and administrative trust.
School ERPs house sensitive minor records, fee collections, and examination results. Krattix is engineered from the ground up with cryptographic isolation, strict role-based access, and the core principles of India's Digital Personal Data Protection (DPDP) Act.
Tenant-Scraped Data Isolation
Every database query executed across the Krattix ERP is strictly scoped by an immutable school tenant ID extracted directly from the verified cryptographic JWT session. No school can ever query, inspect, or leak data belonging to another campus.
Verified Technical Controls:
- Cryptographically bound session headers
- Tenant context middleware on every API route
- Zero shared memory leaks between campuses
AES-256 Field-Level Encryption
Highly sensitive citizen and student identity attributes (such as Aadhaar, National ID, and SAMAGRA numbers) are encrypted at rest using AES-256-GCM before entering the database tables, and masked automatically on screen.
Verified Technical Controls:
- AES-256-GCM cryptographic encryption at rest
- On-screen masking (e.g., •••• •••• 1234) for staff
- Separated cryptographic key management
Bcrypt Credential Hashing
Passwords, parent PINs, and authentication secrets are salted and hashed using the industry-proven bcrypt algorithm with strict work factors. Plaintext credentials are never stored, logged, or visible to system administrators.
Verified Technical Controls:
- One-way salted bcrypt credential hashing
- Zero plaintext password storage or log exposure
- Automated rate-limiting on login attempts
Zero Student Behavioral Profiling
Krattix is built strictly as institutional infrastructure, not an ad-tech network. We do not monetize student data, run behavioral profiling, or host third-party advertisement trackers.
Verified Technical Controls:
- No ad networks or commercial behavioral tracking
- Student records used strictly for school education workflows
- Parental consent mechanisms for minor records
Time-Limited Signed Storage URLs
Student photos, transfer certificates, fee receipts, and marksheet PDFs are stored in private Cloudflare R2 object storage. Documents can only be accessed via short-lived, cryptographically signed URLs.
Verified Technical Controls:
- Private non-public object storage buckets
- Expiring cryptographic access signatures
- Direct-to-storage secure upload bypass
Tamper-Proof Audit Trail
Critical financial, examination, and attendance actions produce immutable audit logs capturing the user ID, timestamp, IP address, and before/after state diffs to ensure full accountability.
Verified Technical Controls:
- Immutable logs for fee waivers and mark overrides
- Before/after state diff recording
- Maker-Checker dual authorization for sensitive actions
Purpose limitation and verifiable consent for student data.
Under modern privacy standards and the Digital Personal Data Protection framework, educational institutions are the legal custodians of student personal data. Krattix operates strictly as a data processor, ensuring full data sovereignty remains with the institution.
Purpose-Bound Processing
Data collected during admission is processed exclusively for school administration, attendance tracking, and academic reporting.
Zero Third-Party Advertising
Student profiles are never exposed to advertisers, data brokers, or marketing syndicates.
Role-Restricted Staff Access
Teachers only view the classes they teach. Financial records are strictly sealed to authorized accountants and school directors.
Local Indian Cloud Residency
Primary databases and application compute instances operate within secure enterprise cloud data centers in India.
Have security inquiries or need an institutional compliance review?
Our engineering team is available to discuss your campus architecture, data retention policies, and technical safeguards.