Security
Your trust is everything to us. Here is how we keep your data safe.
Encryption
Every connection to Sorora Learning uses HTTPS. Data is stored in Google Cloud's Mumbai region, encrypted at rest, in a database reachable only from our private network over encrypted connections.
Passwords & sign-in
Passwords are stored only as one-way BCrypt hashes, never in readable form. Sign-in sessions are short-lived and refresh tokens rotate, and repeated sign-in attempts are rate-limited.
Payments
Payments are handled by Razorpay, a PCI DSS–compliant payment gateway. Card, UPI and bank details are entered on Razorpay's checkout and never reach our servers.
Access controls
Each role — student, parent, teacher, school — sees only what it needs. Parents see their linked child's progress but not their AI tutor conversations, and staff access to user data is restricted and logged.
Child safety
The AI tutor filters its replies for age-appropriateness. We show no advertising and never use students' data for targeted advertising.
Data minimisation
We collect only what the learning service needs: no date of birth, home address, photos or government ID, and voice input is transcribed without the recording being stored.
Report a Vulnerability
If you find a security vulnerability, please email [email protected] with the steps to reproduce it. We acknowledge reports within 2 business days and will keep you updated while we fix it. Please give us reasonable time to fix the issue before disclosing it, and do not access other users' data, disrupt the Service or run automated attacks while testing.