Security & Trust
How ZeroSuite protects the data schools and institutions trust us with. This is a short overview for school leaders and IT teams. For a fuller security document, our sub-processor list or a Data Processing Agreement, just ask.
Last updated: 11 July 2026
Hosting & location
The application and database run on managed cloud infrastructure in the Singapore (Asia) region. Encrypted database backups are stored with our object-storage provider. Schools that need U.S.-region hosting can raise it before signing.
Encryption
Data is protected with HTTPS/TLS in transit, and sensitive identifiers such as government IDs and bank details are encrypted at rest.
Access & audit
Access is role-based, so users see only what their role allows. Administrative access is restricted on a need-to-know basis, and the platform keeps audit logs of logins and record changes.
Sub-processors
We use a small set of vetted providers to run the platform. Each may use data only to perform its service for us. The named list is public.
No sale, no ads
We do not sell student data, do not use it for advertising or profiling, and do not use it to train public or third-party AI models.
Incident response
If we confirm a security incident affecting a school’s data, we notify the school without undue delay, within the timeline set in the signed Data Processing Agreement.
Compliance posture
- For Indian institutions, our processing follows the Digital Personal Data Protection Act, 2023.
- For U.S. schools, we sign a Student Data Privacy Addendum with FERPA-aligned controls and COPPA commitments for children under 13.
- We support schools in meeting applicable student-data privacy requirements, including FERPA-aligned contractual controls where applicable. We do not claim to be “FERPA certified,” because FERPA compliance rests with the school.
See our Privacy Policy and sub-processor list for detail.
Your data, your control
Schools can request an export of their data in a common format during the term and for a short window after it ends. When a contract ends, we delete or return the data and provide written confirmation of deletion on request. We assist schools with access, correction, export and deletion requests from students and parents.
Security questions & questionnaires
We are glad to complete a school’s security questionnaire and to share our Security Overview, sub-processor list and Data Processing Agreement during procurement. Ask us about hosting region, backups and where support staff can access data from.