Breach Notification Policy

1. What counts as a breach

Any unauthorised access to, disclosure of, alteration of, or loss of personal data held in the platform. It includes a school's data being reachable by another school, an account being taken over, and data being lost without a recoverable backup.

2. What we do

1. 1Contain it. Whatever is leaking is stopped first, before anything else.
2. 2Establish the facts: what data, whose, how, for how long, and whether it was actually accessed.
3. 3Notify each affected School without undue delay and in any event within 72 hours of becoming aware, with what we know at that point — including where the picture is still incomplete.
4. 4Notify the Data Protection Board of India as the DPDP Act requires, and assist each School with any notification it must make.
5. 5Fix the cause, and tell affected Schools what was changed.
6. 6Write it up afterwards: what happened, why, and what has changed so it does not happen again. Affected Schools get that account.

3. What a notification will contain

• What happened and when we became aware of it.
• Which categories of data and roughly how many people are affected.
• What the likely consequences are.
• What we have done and are doing.
• What the School or the individual should do, if anything.
• Who to contact for more.

4. What we will not do

We will not delay a notification to finish an investigation, minimise it in the telling, or wait to see whether anyone notices. A partial notification on time is better than a complete one too late.

5. If a school suffers a breach

If a School's own account is compromised — a shared password, a device left signed in — it should tell us immediately. We can revoke sessions, force a password reset, and give the School the audit trail of what that account did.