Security
Every row in our database carries both an organisation id and a school id. Every read and write checks both. A school admin in one organisation can never see, list, search, or accidentally touch data belonging to another organisation — enforced at the service layer, not just the UI.
Each user's role inside their organisation (Org admin, Principal, Teacher, Accountant, Parent, Student) maps to a permission set. Every page route, every server action, and every export gate checks the active user's permissions before serving data. Org admins can audit role assignments at /settings/team.
TLS terminates at Vercel for production traffic. The Postgres database is encrypted on disk. Passwords are bcrypt-hashed (cost 10). We never store payment card details — Razorpay handles those under PCI scope.
Sign-in attempts are throttled per email (5 failures in 5 minutes locks the account for 5 minutes). Public endpoints (the admission form, password reset, student search) are rate-limited per IP or per user. Server actions are CSRF-protected by Next.js's origin check.
Every mutation — a student edit, an attendance save, a fee payment, an invoice cancellation, a logo change, a role assignment — writes an entry to a tenant-scoped audit log. Org admins can search the log at /settings/audit.
Found something? Email security@campustics.com. We acknowledge within 2 business days and credit responsible disclosure in our release notes.
Technical reference: docs/SECURITY.md in our codebase.
