An unknown institution host does not fall back to shared institutional data. The request is refused when the tenant cannot be resolved.
BackBoundaries before
Trust is part of the product
Boundaries before
feature theatre.
Institute software handles student, staff, academic and money records. We explain the current controls and current limitations without inventing certifications or calling a future integration live.
Owner, Admin, Teacher and Student experiences are driven by the authenticated role returned by the system. Selecting a login tab does not create permission.
Administrative and institutional changes are designed with identified actors and audit records where the workflow requires attribution.
Issued access can be rotated or revoked and active sessions can be invalidated when staff access changes or a security concern is reported.
Supported public web traffic uses HTTPS/TLS. Passwords are stored as one-way hashes rather than readable text.
Data-protection and deletion requests go to privacy@smarthisaabeducation.in. Security reports use a separate address.
Infrastructure transparency
Who helps deliver
the service.
Vercel delivers the web applications, Render runs the backend application, Neon provides the PostgreSQL database in Singapore, and Meta's WhatsApp Business Platform delivers authorised messages where enabled.
Vercel
Public web delivery and application hosting for the SmartHisaab Education interfaces.
Render + Neon
Backend application hosting and the PostgreSQL data layer used by the service.
Meta WhatsApp
Recipient number and authorised message content are processed to deliver supported WhatsApp messages.
Clear payment responsibilities
Institute owners pay SmartHisaab Education subscription invoices through PhonePe. Students and guardians pay their institute directly using its available payment methods; those fee payments are recorded in the institute ledger.
Our published commitments
We do not claim a certification, guaranteed uptime, PCI scope, penetration-test status or bug-bounty programme that has not been established. This page describes implemented product boundaries and documented operational practices—not a substitute for a customer's own compliance assessment.
Read the Privacy Policy, Terms of Service, or use the Security Report route for a suspected vulnerability.