/ trust & security
Security is an architecture.
Not a checklist. Edulexa is built on a multi-tenant primitive that makes cross-tenant data leakage structurally impossible.
/ certifications
SOC 2 Type II
Audited annually by Prescient Assurance. Latest report under NDA.
GDPR + DPDP
EU SCCs and India DPDP addenda available with every MSA.
ISO 27001
Aligned controls; certification audit Q3 2026.
AES-256 at rest
AWS KMS envelope encryption with customer-managed keys on Enterprise.
TLS 1.3 in transit
Modern ciphers only; HSTS preload on every endpoint.
HIPAA-ready
BAA available for healthcare-adjacent EdTechs.
/ architecture
Isolated tenancy
Every Enterprise tenant gets a dedicated AWS Fargate cluster and Aurora Serverless v2 instance. Zero shared compute. Zero shared storage.
Region-pinned data
PII never leaves the customer's chosen region. Enforced at the storage layer with policy-based encryption keys.
Defense in depth
WAF + edge rate limiting + L7 anomaly detection + per-tenant network ACLs + runtime application self-protection.
Append-only audit log
Every API call, every admin action, immutable for 7 years. Streamable to your SIEM via Kinesis.
Quarterly pen tests
Independent third-party tests with executive summaries shared with Enterprise customers.
24/7 incident response
Mean time to acknowledge: under 8 minutes. Status page updates within 15 minutes of any P1.
Need a SOC 2 report, DPIA, or pen test summary?
Email security@edulexa.com — we respond within one business day.