Security
Your institution's data, kept the way you would keep it yourself.
Acado holds the records an institution depends on: who is enrolled, what was paid, what was marked. These are the controls behind that trust, in plain language. Your IT team is welcome to ask for the detail.
Controls
Nine things that are always on.
Each institution kept apart
Every query in Acado is scoped to one institution. A school's records are never in the same result as another's, and a group sees its campuses only through its own group login.
Access by role
Principals, accountants, teachers, parents and students each see only what their role allows. Roles and approval chains are set by the institution, not by us.
Encrypted in transit and at rest
Connections use TLS. Stored data and backups are encrypted. Passwords are hashed; one-time passwords protect logins where the institution turns them on.
Hosted in India
Acado runs in cloud data centres in India. Institution records do not leave the country unless an institution asks and the law permits.
Backed up daily
Automated daily backups, kept on a rolling cycle and tested by restoring them. A point-in-time copy can be produced on request.
Your data, exportable
A full export of an institution's records is available whenever it asks, during the agreement and on leaving. No lock-in.
Payments never touch Acado
Online fees are paid on the gateway's own pages into the institution's own Razorpay or PayU account. Acado records the result and issues the receipt; card and bank details are never stored.
Audit trail
Changes to fees, marks, attendance and settings are logged with who made them and when, so an institution can answer the question "who changed this?".
A named person for incidents
Security concerns and data requests go to a named officer, with acknowledgement within 48 hours. Institutions are told of any incident affecting their data without undue delay.
For your IT team
What we can give you before you sign.
- A data processing agreement on request, setting out roles, sub-processors and retention
- A list of sub-processors (hosting, SMS, email, push notifications, crash reporting, payment gateways)
- Export in open formats: Excel and CSV for records, PDF for documents
- Single sign-in per person across the web app and the mobile app, with institution-controlled access removal
- Planned maintenance announced in advance; updates ship without downtime on your side
Reporting a concern
Found something? Tell us first.
If you believe you have found a security weakness in Acado, write to [email protected] with the details. We acknowledge within 48 hours, keep you informed while we fix it, and do not take action against good-faith reports. Please do not access or alter anyone else's data while testing.
Ask us the hard questions in the demo.
Bring your IT lead. We will show where the data lives, how access is controlled and how an export looks.