CHERI SMS School Management Coming Soon
|
CheriMathLab LIVE Get Started
Security & Compliance

Built with the school audit conversation in mind

Schools sign a vendor in a procurement process that’s often more about IT, legal and compliance than about features. The page below summarises how CHERI SMS handles authentication, data protection, anti-cheating, audit logging, and the regulatory frameworks Indian and international schools have to answer to.

Authentication & access

Who’s logged in, and what they’re allowed to do

OTP and 2FA

Email or phone OTP at sign-up. Optional TOTP-based 2FA for staff and admin accounts. Suspicious-login alerts trigger a re-verification rather than a silent allow.

JWT sessions, server-side revoke

Short-lived JWT access tokens with refresh-token rotation. Server-side blacklist on logout, password change, or when an account is disabled, so a stolen token can be cut off centrally.

11 roles, 8 permission types

From SuperAdmin to Student, with eight permission types per module (View, Add, Edit, Delete, Approve, Export, Import, Print) and individual overrides where a school needs to deviate from the role default.

Data protection

How student and staff data is stored and moved

AES-256 at rest

Sensitive fields (national IDs, financial records, contact details) are encrypted at the column level using AES-256. Backups inherit the same encryption.

TLS 1.2+ in transit

All traffic to the platform runs over TLS 1.2 or higher with HSTS preload. Internal service-to-service calls inside the cluster are mutually authenticated.

Multi-tenant isolation

Every record carries a school ID, and every database query is forced through a tenant filter at the framework level. A teacher in School A cannot read a row that belongs to School B, even by mistake.

Input sanitisation (DOMPurify)

Any user-generated content rendered as HTML (announcements, chat, comments) is run through DOMPurify before display. The XSS attack surface stays small and well-defined.

Data residency on request

Schools that need to keep data inside India, the UAE or another specific jurisdiction can pin their tenant to that region’s database cluster. We can talk through the residency contract during onboarding.

File-share scoped delete

Files attached in chat are scoped to the conversation, time-boxed (24-hour auto-delete by default), and traceable. The intent is to support genuine teaching context, not a general drop box.

CheriMathLab fair-play

Six things that make graded quizzes fair to everyone

These are on by default for every published quiz inside CheriMathLab. The teacher doesn’t configure them.

Tab and window detection

If the student switches tabs or minimises the window during a graded quiz, the system flags the event and notifies the teacher.

Screenshot blocking

The browser’s native screenshot path is blocked on the quiz page, so questions can’t easily be shared on WhatsApp during the quiz.

Question randomisation

Both question order and option order are randomised per student, so two learners next to each other don’t see the same paper.

Per-question timer

Each question has its own time budget. Time runs forward only, so seconds saved on an easy question can’t be banked for a hard one.

AI tutor disabled

The AI tutor is unreachable inside a graded quiz, so a student can’t hop into chat and ask the assistant for the answer.

Auto-submission on disconnect

If the network drops or the browser closes, the in-progress attempt is submitted with whatever’s been answered, rather than being lost.

Privacy posture

Specific privacy decisions that matter to schools

Direct messages stay private

One-to-one chats between a teacher and a student or parent are private. Admins do not see the body of a DM in their normal admin view. Access only opens up under a documented abuse-investigation flow, with a logged justification.

File uploads are scoped and time-boxed

File sharing in chat is intended for STEM teaching artefacts (handwritten working, diagrams, problem sets). Files default to a 24-hour auto-delete, and consent to the file-sharing terms is recorded server-side.

UTC timestamps everywhere

Every action is logged in UTC, and the footer of the dashboard shows the user’s local timezone next to the UTC offset. There’s no ambiguity over “what time was that quiz submitted?” during a parent-teacher review.

Push notifications are opt-in

Browser and mobile push notifications require an explicit opt-in. Consent withdrawal is on the roadmap as a one-click control on the user’s profile page, alongside data-export and account-deletion options.

Audit and logging

Every action attributable to a user

CHERI SMS is built on the assumption that an external auditor will eventually look at the logs. The logging is structured for that, not bolted on afterwards.

  • API logs: every request to the platform’s API endpoints is logged with the user, IP, timestamp, and outcome.
  • Audit trails: changes to grades, finance records, attendance and student personal data carry a before-and-after snapshot.
  • Error logs: stack-trace-level error logs are captured with sensitive PII automatically redacted before storage.
  • Clickstream: high-level navigation events are recorded for support and incident-investigation purposes, not for ad targeting.
  • Retention windows: log retention is configurable per tenant, with sensible defaults (90 days for ops logs, 7 years for audit-relevant changes in line with India’s common record-keeping requirements).
Audit log · last 24h
Recent activity
grades.updateMr. Rao · Class 9-BView
student.profile.editAdmin · 2 fields changedView
fees.payment.receivedUPI · ₹12,500View
login.failed3 attempts · IP 49.207.x.xView
chat.dm.readInvestigator · ticket 1147View
Regulatory frameworks

The frameworks we design with in mind

We don’t certify against every framework. We do design the data model, the consent flows and the audit trails so that schools can answer their own auditors.

UDISE+

Student records, attendance and basic school info are structured to support UDISE+ reporting in Indian schools.

RTE Act

Admission tracking, fee structures and attendance rules are configurable to align with state-level RTE-quota requirements.

NEP 2020

Multi-disciplinary courses, holistic report cards and the 5+3+3+4 structure are first-class concepts in the data model.

GDPR / DPDP

Consent tracking, data-export, account-deletion and breach-notification workflows are built in. GDPR for international schools, DPDP for Indian schools.

Want to dig deeper before bringing your IT and legal teams in?

We’re happy to do a 45-minute call with your IT lead and walk through any specific section in detail.