Trust & data protection
Your students’ data belongs to your institution. We process it on your instructions.
Under the Digital Personal Data Protection Act, 2023, your institution or department is the Data Fiduciary and Pareeksha is your Data Processor. This page says what is in place today, what is written into the agreement, and what is still being built, so your procurement team does not have to guess.
Safeguards
What protects your students’ data
7 of 10 measures below are in place today. The rest are marked.
Mobile numbers encrypted at restIn place today. Phone numbers are stored with AES-256-GCM field encryption and looked up through a keyed hash (HMAC-SHA256), so the database never holds a readable number. Screens show the last four digits.
Consent recorded as a ledgerIn place today. Every WhatsApp/e-mail consent and every parent-contact change is an append-only record: who, when, what wording, granted or withdrawn. Consent is never assumed from silence.
No ads or third-party trackers on student pagesIn place today. Your student site carries no advertising, no ad pixels and no Pareeksha upsells. Parent report links are excluded from all analytics.
Parent reports only with consentIn place today. A teacher can add a parent’s number only after confirming consent; the student is notified and can stop parent reports at any time. Parent links expire in 14 days.
Audit log of staff actionsIn place today. Privileged actions in your console (batches, invites, test assignment, parent contacts, plan changes) are logged with who, when and which institution.
One institution never sees another’s dataIn place today. Every console request is checked against the signed-in person’s membership and role in that institution, on the server, before any data is read.
Deletion that actually deletesIn place today. A student’s deletion request clears their personal data from every table that holds a copy and is recorded in a deletion register. Anonymised scores are kept so other students’ percentiles stay correct.
Data export and return at contract endWritten into the agreement. Roster, attempts and results handed back in CSV, then your institution’s data deleted, with a written confirmation. Committed in the agreement; self-serve console export is being built.
Verifiable parental consent for under-18 studentsBeing built. Required by the DPDP Act for students under 18. Being built; we will not onboard junior-college or school cohorts until it is live.
Hosting regionWritten into the agreement. To be confirmed in the agreement. For government programmes that require India-region hosting we will state the region in writing before signing.
Data
What we collect, and why
Only what is needed to run tests and reports for your institution.
Student data
- Name, mobile number (encrypted), and e-mail if the student gives one.
- Batch, centre or district you place them in.
- Test attempts, answers, scores and time taken.
- Language preference and exam interests.
What we do not do
- No advertising to your students, and no ad pixels on your student site.
- No sale or sharing of student data with anyone for marketing.
- No use of your students’ contact details to sell them Pareeksha’s own products.
- No mobile number in logs, alerts or analytics; only the last four digits.
Sub-processors
Service providers we use
Every provider processes data only to run the service. The list and each provider’s role are in the data processing agreement, and we tell you before adding a new one.
| Provider | Used for |
|---|---|
| Neon (PostgreSQL) | Main database |
| Cloudflare | Hosting the website and application, file storage |
| Upstash (Redis) | Rate limiting and short-lived cache |
| WhatsApp messaging provider | Login OTPs and, with consent, parent reports |
| Zoho | Invoices, support tickets and e-mail |
| Razorpay | Online payments, where the institution pays online |
Hosting region: to be confirmed in the agreement. For government programmes that require data to be stored in India, we confirm an India-region arrangement in writing before signing.
Procurement
Documents for your procurement team
Available on request during a pilot or tender:
- Data processing agreement (institution as Data Fiduciary, Pareeksha as Data Processor).
- Security overview, for vendor-security questionnaires.
- Hosting and data-residency statement.
- Load-test and tenant-isolation test reports for your exam window.
Students’ own rights (access, correction, deletion, grievance) are described in our privacy notice.
Book a demo
Ask for the trust pack.
- We send the documents above, and answer your security questionnaire.
- A call with your IT or procurement team if you need one.
Want to look first? Open the live demo. It runs on sample data, nothing to sign up for.