- Isolation: every record is tagged to its institute; queries are filtered by institute so one institute cannot see another’s data.
- Role-based access: owner, admin, teacher, accountant, parent and student roles see only the modules and records they are allowed to; permissions are checked on every page and API.
- Passwords: stored only as secure hashes; login attempts are rate-limited; users can change passwords.
- Web protections: HTTPS, CSRF tokens on forms, prepared database statements, security headers, and blocked access to configuration, storage and backup folders.
- Payments: handled by Razorpay; we never see or store card or UPI credentials. Payments are verified on our server and by signed webhooks before a plan is activated.
- Audit trail: important changes such as attendance corrections, fee cancellations and permission changes are logged with user and time.
- Secrets: database credentials and payment keys are kept in a private server configuration file, not in public code.
No system is completely risk-free. If you suspect a security problem, report it immediately: Email support@myerpcrm.com, phone +91 97623 40695. We investigate every report and notify affected institutes without undue delay where required.
We do not claim any third-party certification. Institutes remain responsible for how they collect and use student data under applicable law.