Security & privacy
You are handing us records about your alumni and, if you use mentoring, about children in your care. Here is how they are held, who can see them, and what we have not built yet.
Where the data lives
Everything is hosted in Google Cloud's Mumbai region (asia-south1) — the application, the PostgreSQL database and the file storage. Your alumni records do not leave India. Data is encrypted in transit with TLS and encrypted at rest by the managed database service.
One school cannot see another
Every record carries the school it belongs to, and every query is filtered by it before anything else runs. Two checks sit in front of each request: one resolves which school is being addressed and confirms it is active, the second confirms the signed-in person actually belongs to that school — an administrator at one institution is not an administrator at another.
That second check is enforced by an automated test that reads the application's own routing table and fails the build if any authenticated route is missing it. The handful of deliberate exceptions are listed in the test with the reason for each, so adding one is a visible decision rather than an oversight.
Members decide who can see them
Each alumnus chooses whether their profile is visible to the whole network, to their own batch only, or to nobody. That choice is applied in the database query itself, not hidden in the interface, so it holds however the data is requested.
- Email addresses and phone numbers are never included in a directory response.
- A member can erase their own record, and erasure is scoped to one school — someone who attended two institutions on the platform stays a member of the other.
- Every email carries a working unsubscribe link, and opting out is recorded in an append-only ledger the database will not let us edit or delete afterwards.
Students are treated as children, because they are
- Student records are visible to school staff only. Alumni cannot browse them.
- Contact details are withheld from anyone who is not an administrator.
- A mentor sees a first name, a year and a subject stream — never a way to make contact outside the school's own process.
- A teacher may suggest a mentor for a student; only an administrator can approve it.
- Every staff read of a student or member record is written to an audit log.
Accounts and access
- Passwords are hashed with Argon2id. We never see or store the original.
- Two-factor authentication is available for staff accounts.
- Sign-in sessions expire after 30 days.
- No alumnus becomes visible until your staff approve them.
- We do not store card or bank details. When giving is switched on, payment details go directly to the payment provider and never reach our servers.
What we log, and what we deliberately do not
Administrative actions and reads of personal data are recorded with the school, the person acting, the route and the outcome. IP addresses are stored only as a one-way hash. Names, email addresses and phone numbers are stripped from application logs by default.
What we have not built yet
Giving is not switched on. The payment flow is built but has never processed a real transaction, and no payment provider key exists in our production environment. We will tell you when that changes rather than letting you discover it.
We have no external certification. No SOC 2, no ISO 27001, no third-party penetration test. If your institution requires one, say so early — it is a reasonable thing to require and we would rather not waste your time.
Database backups are automated but we have not rehearsed a restore. Until we have, we will not quote you a recovery time.
Members cannot yet export their own record. Erasure works today; portability is being built. Your administrators can export the directory.
Consent for pupils under 18 is your process, not ours. We hold student records on your instruction as the data fiduciary. We have not built parental consent capture, and you should not assume the platform handles it.
If you find a problem
Write to security@kaayko.com. We will acknowledge within two working days. We do not run a bounty programme and we will not threaten anyone who reports something in good faith.
For privacy questions, data requests, or anything under the Digital Personal Data Protection Act: privacy@kaayko.com.