Security & Data Protection

Your Institute Data is Protected

OnCampus is designed with security and privacy as a core principle. We use modern security practices to protect institute operations, student records, and communication data.

Encryption & Secure Communication

All data transmitted between users and the OnCampus platform is encrypted using TLS (HTTPS). This helps protect student records, institute details, and authentication sessions while data is in transit.

Sensitive data such as passwords are stored using secure cryptographic hashing with bcrypt rather than plaintext storage.

Secure Data Storage

OnCampus stores institute and student data in secure cloud-backed databases with controlled access. Data is scoped by institute so one organization cannot access another organization's records through the application.

We avoid making claims about custom application-level encryption that are not part of the current implementation.

Secure database access controls
Infrastructure-level encryption provided by cloud providers
Institute-scoped data access patterns across application records
Protection against unauthorized access through authenticated and authorized requests

Role-Based Access Control

Access to sensitive data is restricted using role-based access control. The current platform supports Owner, Manager, and Viewer roles.

Each role has specific permissions that limit what actions users can perform inside the system.

Only owners can manage billing and team members
Managers can handle operational workflows and institute data updates
Viewers have read-only access to operational data

Secure Multi-Tenant Architecture

OnCampus uses a multi-tenant architecture where each institute operates within its own scoped data environment.

Records are associated with an institute identifier, which helps ensure that one institute cannot access another institute's data through normal application flows.

Authentication & Session Security

User authentication and session handling use multiple protections designed to reduce unauthorized access risk.

Secure password hashing with bcrypt
Signed session tokens
HTTP-only cookies for session storage
Session expiration policies with bounded token lifetime

Secure Communication Integrations

OnCampus integrates with the official Meta WhatsApp Cloud API for operational alerts.

Communication between OnCampus and external services is performed over encrypted HTTPS connections, and message logs are stored for operational tracking within the platform.

Institute Data Ownership

Institutes fully own their data.

OnCampus does not sell, share, or expose institute or student data to third parties.

Data is used only for providing and operating the platform services.

Continuous Security Practices

Validated API inputs using schema-based validation
Role-based authorization for sensitive actions
Rate limiting on public lead capture forms
Webhook signature verification for payment events
Scoped institute access patterns across data operations

Built with Security in Mind

OnCampus is designed to provide a secure environment for managing institute operations and student records.

Security improvements continue to evolve as the platform grows.

Encryption & Secure Communication

Sensitive data such as passwords are stored using secure cryptographic hashing with bcrypt rather than plaintext storage.

Secure Data Storage

We avoid making claims about custom application-level encryption that are not part of the current implementation.

Secure database access controls

Infrastructure-level encryption provided by cloud providers

Institute-scoped data access patterns across application records

Protection against unauthorized access through authenticated and authorized requests

Role-Based Access Control

Access to sensitive data is restricted using role-based access control. The current platform supports Owner, Manager, and Viewer roles.

Each role has specific permissions that limit what actions users can perform inside the system.

Only owners can manage billing and team members

Managers can handle operational workflows and institute data updates

Viewers have read-only access to operational data