Data Ownership & Security
NetCyberAI keeps each school’s data isolated from every other school, and that isolation is enforced today by row-level security in the database itself. Letting a school export a full copy of its own records, so it is never locked in, is a locked design commitment that is planned but not live yet. This page separates the two plainly.
Current status: pilot build
The NetCyberAI database, sign-in and school isolation are live. Enquiries sent through this website are stored in that database. Outbound WhatsApp is switched off for every school by default and is only enabled deliberately for a pilot. Each section below says whether it describes something running today or something still planned.
Consent, before anything else (DPDP)
Enforced in the database schema today: every student record is created in a quarantined pending_consent state, including bulk CSV imports of hundreds of students at once. No outbound message and no recognition scoring reaches a student until consent is recorded. Daily Pulse, Weekly Brief, and Recognition are each a separately consentable purpose, defaulting to off, independently withdrawable at any time — turning one off does not require turning the others off.
WhatsApp privacy
Permanent policy, not a configurable setting: every parent message is sent 1-on-1. WhatsApp Groups are never used for parent communication, because a group would expose every parent’s phone number to every other parent in that group — a privacy problem with no consent basis, and one we refuse to build regardless of how a school asks for it.
No third-party tracking on your data
No third-party analytics script, advertising pixel, or session-replay tool runs on any authenticated page where school or student data would be visible — this is a standing rule, not a future promise. It already applies to this site: this website itself sets no third-party tracking cookies and loads no ad or analytics pixels.
Where your data lives
Live today: the school database runs on Supabase in its Mumbai, India region (AWS ap-south-1), so operational school data is stored in India by default. Supabase’s own platform states that customer data is encrypted at rest with AES-256 and in transit via TLS. That is a default of the underlying infrastructure, not a feature we built ourselves.
Source: Supabase’s security page. Checked 16 September 2026.
Every query scoped to your school
Live today, and tested: every operational table carries a school identifier, and access is restricted using Postgres Row-Level Security — enforced by the database itself, not only by application code that a future bug could bypass. No table is exempt from this rule, and a two-school isolation test suite checks that one school cannot read another’s rows.
Exporting your data
Planned, not live yet: a school will be able to take a full export of its own records in standard formats (CSV / SQL), not a proprietary format that locks you into the platform. The database exists, but the export itself has not been built, so we are not claiming an export button exists today.
If you leave
Planned, not live yet: on offboarding, a school receives a full export of its data before deletion, and we intend to publish a specific retention and deletion timeline once that operational process actually exists, rather than promise a number now that nothing has tested.
Frequently asked questions
Can a school export all of its own data?
This is planned, not live today. It is intended to be exportable in standard formats — CSV or SQL — rather than a proprietary format, so a school is never locked into the platform.
Where is school data stored?
The NetCyberAI database runs on Supabase in its Mumbai, India region (AWS ap-south-1), so operational school data is stored in India by default.
How is children’s data handled under the DPDP Act?
No student record becomes active without a verifiable consent record from a parent or guardian. A bulk import creates records in a pending-consent state rather than an active one, and each communication type — Daily Pulse, recognition, Weekly Brief — is separately consentable and defaults to off until specifically granted.
What happens to our data if we leave?
This is planned, not live today: on offboarding, a school is intended to receive a full export of its data before deletion, with a specific retention and deletion timeline published once that operational process actually exists and has been tested.
Does NetCyberAI use third-party analytics?
No third-party analytics script, advertising pixel, or session-replay tool runs on any authenticated page where school or student data would be visible. This public website itself also sets no third-party tracking cookies.
Have a specific question?
Ask us directly on WhatsApp, or write to admin@netcyberai.com.