Vera Edu Security & Compliance

1. Zero-Trust Architecture for Education

In school environments where hundreds of students, teachers, and parents access the system daily across smartphones, tablets, and campus laptops, perimeter security is insufficient.

Vera Edu implements a Zero-Trust Security Architecture: every session token is strictly validated, every database transaction is policy-checked at the PostgreSQL kernel layer, and no user or device is trusted implicitly.

2. Database Row-Level Security (RLS)

Rather than relying solely on application-level routing guards, data segregation is enforced directly at the database engine through PostgreSQL Row-Level Security (RLS) policies:

• Students: Can only execute SELECT queries on their own assignments, grades, and attendance entries.
• Parents: Access is cryptographically constrained to verified linked children via family relation tables.
• Teachers: Can only write grades, notes, and attendance for classes and subjects officially assigned to them in the institutional timetable.
• Cross-School Isolation: Multi-tenant isolation ensures no query can ever leak data across distinct educational institutions.

3. Cryptographic Storage & Transmission

All data in transit is protected using TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS) and perfect forward secrecy. All student tables, identity identifiers, and backup disks are encrypted at rest with hardware-accelerated AES-256.

4. Role-Based Access Control (RBAC) & Session Safety

User sessions employ secure, HTTP-only, SameSite authentication tokens. Administrative consoles support granular permission assignments (Principal, Vice-Principal, Secretariat, IT Coordinator, Department Lead) preventing excessive privilege escalation.

5. Immutable Audit Logs & Grade Tamper Defense

Every evaluation entered or updated into the digital register produces an immutable audit event recording:

• The authenticated teacher identifier.
• Exact UTC timestamp and originating IP subnet.
• Previous grade value and updated value.
• Mandatory justification comment for post-scrutiny grade corrections.

6. Automated Redundancy & Disaster Recovery

School records are backed up continuously using Point-in-Time Recovery (PITR) with automated snapshots replicated across geographically isolated data centers within the European Union, guaranteeing an RPO under 5 minutes and RTO under 2 hours.

7. Certifications & Infrastructure Compliance

Our core hosting partners maintain compliance with SOC 2 Type II, ISO/IEC 27001:2013, ISO/IEC 27018 (Code of practice for protection of personally identifiable information in public clouds), and European Cloud Code of Conduct.

8. Vulnerability Reporting & Incident Protocol

Security researchers and school IT departments can report suspected security issues directly to security@verapiu.com. In the event of a verified security incident affecting student records, subscribing schools are notified within 24 hours in compliance with GDPR Art. 33.