You are handing us children's records.

Where your data lives

On Amazon Web Services in the ap-south-1 region — Mumbai. Your students' records do not leave India. That is a deliberate choice: it keeps the data inside the jurisdiction whose law actually governs it, and it is the answer a correspondent's auditor will ask for.

How your school is separated from every other school

Every record that belongs to a school — students, guardians, fees, marks, attendance — carries that school's tenant identifier, and a database-level scope is applied automatically to every query the application makes. It is not a filter a developer has to remember to add; a query written without it returns nothing rather than returning somebody else's children.

Who can sign in, and as what

Kalvi runs four completely separate sign-in systems, not one login with role checkboxes:

• School staff — your teachers and office, scoped to your school only.
• Parents — mobile number plus the access code printed on their slip. The code is stored hashed, never in readable form, and a parent sees only their own children.
• Partners — resellers, scoped to the schools they signed and nothing else.
• Us — platform administration, behind an additional step-up security challenge on top of a password.

A session on one of those cannot become a session on another. We have automated tests whose only job is to keep proving that, because it is the failure that would matter most.

The ordinary things

• Everything is served over HTTPS. There is no unencrypted route into Kalvi.
• Passwords are stored as bcrypt hashes. Nobody here can read yours, including us.
• Sign-in, password reset and contact forms are rate-limited, so a stolen phone number cannot be used to guess codes at speed.
• Sensitive actions — plan changes, staff added, records exported, an administrator signing in as a school — are written to an audit log.

What we have not built yet

A security page that lists only good news is not a security page. As of today:

• We have not had an external penetration test. When we do, we will say who did it and when.
• We hold no formal certification — no ISO 27001, no SOC 2. Any small Indian vendor claiming those is worth asking for the report.
• One-click export of your entire school database is not built yet. Your student roster exports in TN EMIS format today, and we will send you a full dump on request in the meantime.

If any of those is a blocker for your school, tell us — it is better for both of us to know before you sign than after.

Reporting a problem

If you think you have found a security issue, email info@avancezone.com with enough detail to reproduce it. We will confirm we received it within one business day. We will not threaten you for telling us.

Last reviewed: 27 August 2026