Security Architecture

1. Multi-Tenant Row-Level Security (RLS)

The most critical architectural requirement in school management software is complete data isolation. MyEduOS does not rely solely on application-level filtering. Instead, our persistence layer enforcesPostgreSQL Row-Level Security (RLS) directly inside the database engine.

• Automatic Tenant Binding: Every incoming HTTP request resolves the active tenant’s organization_id from verified cryptographic session tokens.
• Engine-Level Enclosure: The database engine automatically rejects any query attempting to select, update, or delete rows outside the active tenant boundary.
• Cross-Campus Governance: Multi-branch schools can administer unified curricula while maintaining strict branch-level partitions across campus accountants, teachers, and front desks.

-- Enforce strict organization boundary on student records
CREATE POLICY tenant_isolation_policy ON students
  FOR ALL
  USING (organization_id = current_setting('app.current_org_id')::uuid)
  WITH CHECK (organization_id = current_setting('app.current_org_id')::uuid);

2. Authentication & Identity Controls

MyEduOS protects institutional user identities with modern defensive mechanisms:

3. Granular Role-Based Access Control (RBAC)

MyEduOS implements a 12-role least-privilege security matrix to ensure that users access only the exact features and records necessary for their duties:

4. Data Encryption in Transit & at Rest

All communication between institution browsers, mobile apps, and MyEduOS servers is strictly encrypted using TLS 1.3.

• In Transit: We enforce HTTP Strict Transport Security (HSTS) with a 365-day preloaded header and modern cipher suites (ChaCha20-Poly1305, AES-256-GCM).
• At Rest: All database volumes, transaction logs, and student file assets (ID card photos, transfer certificate scans, medical notes) are encrypted at rest using AES-256.
• Payment Tokenization: Fee payments made through Razorpay utilize tokenized checkout flows. MyEduOS servers never process, touch, or store sensitive credit/debit card numbers or CVVs.

5. Immutable Audit Logging

Educational institutions require complete transparency when records are updated. MyEduOS maintains an append-only audit trail capturing:

• Academic mark adjustments and report card regenerations.
• Fee waivers, manual receipt entries, and refund authorizations.
• Staff permission grants and administrative role delegations.
• Student status changes, withdrawals, and Transfer Certificate issuances.

6. Responsible Security Vulnerability Disclosure

We welcome responsible vulnerability reports from independent security researchers and community members. If you discover a potential security vulnerability in MyEduOS: