A child’s record is not data. It is a responsibility.
From a first login to a fee receipt, a subscription order and a bus location, every layer is designed to keep the right information with the right people - and to make the wrong access structurally difficult.
0
card details stored by Novara
100%
HTTPS across the platform
1
isolated workspace per school
30 days
for formal data requests
Security posture
Defence in depth
No system is completely secure. What matters is that access is deliberate, incidents have a path, and the school is told when something goes wrong.
Six surfaces. One security model.
Accounts, people, fee money, Novara orders, the app and the infrastructure behind it are treated as separate surfaces with their own controls.
Account security
The first door is the strongest one.
Every session is authenticated, every role is scoped and every password is stored as a one-way hash - never as readable text.
Personal & student data
School records stay school business.
Student, guardian and staff information is processed to run the school - not to sell, advertise or build profiles.
Money & fees
Every rupee leaves a trace.
School fee collection is a financial workflow. The order, receipt, gateway reference and student ledger stay connected.
Novara orders
Subscription billing is a separate ledger.
Your Novara plan has its own order history - plan, seats, invoices and renewals - separate from student fee money.
App security
The same guardrails, in the hand.
The Android app uses secure token storage, HTTPS requests and role-gated routes. Device permissions are tied to the feature that needs them.
Infrastructure & recovery
Boring infrastructure is good infrastructure.
Tenant-scoped queries, least-privilege access, encrypted storage, backups, monitoring and a defined incident path.
School fees and Novara orders are not the same ledger.
One is a family paying the school. The other is the school paying for Novara. They use the same secure gateway, but they never share a record.
School fee money
A parent pays the school
A fee becomes due
The school sets the fee head, term or instalment. The student and parent see the balance in the app.
Razorpay takes the payment
UPI, card or netbanking details are entered on the gateway, not inside Novara.
Novara records the result
Amount, receipt, payment reference and status are written against the student fee record.
The ledger stays reconciled
Receipts are available to the family and the school sees collection, balances and transactions.
Novara subscription
A school pays for Novara
Plan and seats are chosen
The school selects Standard or Pro, billing cycle and approximate enrolment.
A Novara order is created
Plan, seat count, amount and billing period are stored as the commercial record.
Payment is confirmed
Razorpay processes the subscription charge and returns a reference to Novara.
Access follows the order
The invoice and renewal status are recorded; plan gates update when access changes.
What Novara never stores
What Novara records for reconciliation
A simple data map. No mystery boxes.
The categories of information the platform handles, who can see them and how long they stay.
Account & school profile
- Examples
- Admin name, email, mobile, school name, city and billing contact.
- Who can see it
- School admins; limited Novara support and billing.
- Retention
- Active account, then the period required by law.
Student & guardian records
- Examples
- Profile, class, roll number, guardian, address, emergency and medical details.
- Who can see it
- School staff, the linked student and parent, and authorised support.
- Retention
- Controlled by the school; export or delete on request.
Academic records
- Examples
- Attendance, marks, report cards, homework, submissions and lesson material.
- Who can see it
- School staff, the student and parent, and the assigned teacher.
- Retention
- School account life; historical records remain school-controlled.
Fee & payment records
- Examples
- Fee head, amount, receipt, gateway reference, payment status and balance.
- Who can see it
- School finance/admin, the linked family, and gateway support.
- Retention
- Billing and legal retention under the school account.
Messages & media
- Examples
- Direct messages, groups, notices, documents, audio, video and class recordings.
- Who can see it
- Conversation participants, school staff and authorised support.
- Retention
- School account life; media follows the school instruction.
App & device data
- Examples
- Push token, device type, login history and error diagnostics.
- Who can see it
- Security, engineering and support under least privilege.
- Retention
- Minimal; invalid push tokens are removed.
The school controls the data. We protect it.
Novara is built for the DPDP Act, 2023 and aligns with GDPR principles. The school decides why student and staff records are collected; Novara processes them only to run the service.
The school is the data fiduciary or controller for student and staff records.
Novara processes those records on the school’s instructions.
Parents and guardians should contact the school to correct a student record.
We do not sell, rent or trade personal information.
We do not use student data for advertising or behavioural profiling.
Access, correction, erasure, portability and consent withdrawal are supported.
Privacy questions are answered within 48 hours; formal requests within 30 days.
Some subprocessors operate outside India under contractual safeguards.
Service providers
A short, accountable list.
Data is shared only with the providers needed to deliver a function. Each operates under its own data-processing terms.
Convenient on the phone. Still a controlled session.
A phone gets lost, shared or left unlocked. The app is built so that tokens are stored securely, requests are authenticated and the role decides what can be opened.
On the device
- Tokens in Expo SecureStore
- HTTPS-only API calls
- Role-gated screens
- Feature-scoped permissions
On the server
- Authentication on every request
- Tenant-scoped queries
- Short-lived access tokens
- Refresh tokens hashed and single-use
A plan, not a panic. And a way to reach us.
No system is completely secure. What matters is containment, honest communication and a fix that stays fixed.
Detect & contain
Monitoring, alerts and reports trigger an investigation. Access or affected components are contained first.
Assess & scope
We establish what happened, which records and tenants are involved, and what the realistic impact is.
Notify
Affected schools and, where required, authorities are informed in line with the DPDP Act and applicable law.
Recover & review
Service is restored, the root cause is fixed and controls are tightened so the same path is closed.
Responsible disclosure
Found something? Tell us before the internet does.
We welcome good-faith security reports. Include the impact, the steps to reproduce and any safe proof. Please give us time to fix the issue before public disclosure.
Security, without the hand-waving
The questions schools, parents and IT teams ask most often.
School records are stored with our cloud database provider and encrypted at rest. Some service providers are located outside India and operate under contractual safeguards. The full subprocessor list is in our Privacy Policy.
No. Novara does not sell, rent or trade personal information, and we do not use student data for advertising or behavioural profiling.
Access is restricted to people who need it for support, security or engineering, under least-privilege controls and monitoring. Routine support does not browse school records without a reason connected to the request.
No. Card, UPI and netbanking credentials are entered on Razorpay’s PCI-DSS compliant checkout. Novara stores the order amount, receipt, payment reference and status, not the payment credentials.
The school owns its data and content. Novara receives a limited licence to host and process it only to provide the service, secure the platform and comply with law.
We do not claim certification we have not earned. Our controls are designed around ISO 27001 and SOC 2 practices, and formal certification is a later milestone. We will publish verifiable badges when they are issued.
Camera, microphone and location are requested only for the feature that needs them - live classes, AI voice input, file capture and bus tracking. Location is used to show the bus relative to the pick-up point and is shown on the device.
Email support@novaradirect.in with the subject “Security report” or call +91 99636 08010. Include the impact and steps to reproduce, and do not send passwords or full payment details. For a compromised account, contact us immediately so we can contain it.
Still have a question?
Talk to a human who knows the system.
For security reviews, data requests, account concerns or a school walkthrough, reach the Novara team directly.