Compliance & Privacy Policy

1. Multi-Tenant Database Isolation

Attend Desk enforces strict database boundaries for all registered institutions. Each tenant (college, university, or school) operates under isolated scope parameters. Our custom query routing engines prevent cross-campus data leakage, ensuring that student files, roll directories, and faculty login credentials of one institution are never accessible to another.

2. Cryptographic Security Standards

We secure access points through standard-setting cryptographic protocols:

• Secure Hashing: Faculty and Administrator passwords are encrypted using secure modern hashing algorithms (`PASSWORD_DEFAULT`), preventing plain-text storage.
• Stateless JWT Tokens: The Faculty Mobile Rest API uses stateless JSON Web Token (JWT) signatures. Session authentication tokens are expired automatically and require re-authentication.
• 6-Digit OTP Checks: Sensitive events such as registration creation, admin password changes, and student directory bulk deletions are protected via 6-digit email OTP verifications.

3. System Activity Logging

Our platform retains a detailed activity log audit trail for every institution. System Logs monitor the login actions, configuration edits, directory exports, and attendance deletions by user ID, role, timestamp, and IP address. This enables institute administrators and super admins to maintain absolute operational transparency and compliance.

4. Data Ownership & Portability

Academic institutions retain complete ownership of all uploaded data. Attend Desk does not share, analyze, or monetize student directories or attendance logs. Institute administrators can export lists to CSV/Excel or download complete SQLite snapshot files to maintain local offline archives at any time.