Security at CampusKaro

• Password storage: passwords are stored as Argon2id hashes — never as plain text, and never emailed.
• Sessions: short-lived access tokens with rotating refresh tokens; changing or resetting a password revokes other active sessions.
• Recovery: password resets use single-use, expiring links sent to the registered email. Reset responses never reveal whether an account exists.
• Abuse controls: login, registration, OTP and reset endpoints are rate-limited, and OTP codes expire, cool down between resends, and lock after repeated wrong attempts.

• Role-based access: institute owners manage configuration and staff; accountants access only fee operations (collect, pending, receipts) relevant to their work.
• Platform separation: platform administration is a separate workspace, invisible to institute users.

• Tenant isolation: every student, admission, fee, payment and notification record belongs to exactly one organization, and every request is scoped to the authenticated organization on the server. One institute cannot see, reference or affect another's records.
• No tenant input from clients: organization context always comes from the authenticated session — never from values sent by the browser.

• Subscriptions: processed through Razorpay; the server verifies every payment signature and amount before activating anything. The interface never marks a subscription paid on its own.
• Fee collection: each collection carries an idempotency key, so double-clicks and retries cannot create duplicate charges or receipts.

• Fee integrity: admission totals are recomputed on the server from authoritative prices — client-submitted totals are ignored. Later price changes never rewrite existing student records or receipts.
• Audit trail: admissions, payments, configuration changes and access events are recorded with actor, time and network origin.
• Backups: production database backups are part of the deployment routine.

CampusKaro does not claim SOC 2, ISO 27001, PCI certification, penetration-test results or "bank-grade" status. Security is described here in terms of implemented controls, not certifications.

If you believe you have found a security issue, email info@campuskaro.in with a description and steps to reproduce. Do not access other institutes' data or disrupt the service while investigating.