Security

Your Data Stays in India. Contractually.

CavenX secures education AI and institutional communications with end-to-end encryption, India-only hosting, zero-training guarantees, and DPDP Act 2023 compliance from day one.

Last updated: June 27, 2026

Security is not a feature we bolt on — it is the foundation of deploying AI inside schools, universities, and colleges. This policy describes how we protect institutional data, student data, faculty research, and communications across the platform.

1. End-to-End Encrypted Communications

All communication between students, teachers, and non-teaching staff through CavenX channels and rooms is end-to-end encrypted by default — the same class of protection users expect from WhatsApp and Telegram.

Default E2E: Messages, files, and media in channels and rooms are encrypted on the sender's device and decrypted only on recipients' devices.
Institutional boundaries: Encryption keys are scoped per institution. CavenX cannot read message content in E2E channels and rooms.
Every role covered: Students, teachers, faculty, and non-teaching staff — same default protection across all room types.
Metadata minimization: We collect only the metadata required to deliver and secure the service — not message content from E2E communications.

2. India Data Hosting & Localization

All inference, storage, and backups for Indian institutions run exclusively within Indian jurisdiction. This aligns with our DPDP Act 2023 commitments and institutional procurement requirements.

100% India-hosted infrastructure for Indian institutions
No transfer of Indian institutional or student data outside India without explicit legal basis and notice
Contractual data localization with infrastructure providers

3. Encryption & Infrastructure

In transit: TLS 1.3 for all connections
At rest: AES-256 encryption for stored institutional data outside E2E message content
Access controls: Role-based access, SSO integration, principle of least privilege
Network security: Firewalls, intrusion detection, DDoS protection, 24/7 monitoring
Availability: 99.9% uptime SLA for production services

4. AI Zero-Training Guarantee

Institutional data, student inputs, faculty research, and AI outputs are never used to train public AI models — contractually guaranteed with every model provider on the CavenX platform.

Per-institution data isolation for AI workloads
Per-faculty research isolation on higher-ed deployments
No sale of institutional or student data to third parties
Institutions retain absolute ownership of their data — CavenX claims no rights

5. DPDP Act 2023 — Day One Compliance

CavenX is built for compliance with the Digital Personal Data Protection Act, 2023 from first deployment. Full institutional breakdowns are also available on our Schools and Higher-Ed pages.

Requirement	How CavenX Implements It
Consent-driven data handling	Explicit consent for students and staff. Parental consent for minors under 18.
Data minimization	Only necessary academic and institutional data collected — no surplus profiling.
Right to erasure	Students, faculty, and institutions can request complete deletion at any time.
Data localization	100% inference, storage, and backups within Indian jurisdiction.
Zero-training guarantee	Institutional and student data never used to train public AI models — contractually guaranteed with every model provider.
Institutional data ownership	Schools, universities, and colleges retain absolute ownership. CavenX claims no rights.

6. Compliance & Operations

SOC 2 Type II: Annual third-party audits covering security, availability, and confidentiality controls
Penetration testing: Regular third-party assessments
Incident response: Documented process with institutional notification for material incidents
Employee security: Background checks, security training, least-privilege access
Vulnerability disclosure: Report issues to security@cavenx.com

Contact

Security questions or vulnerability reports: security@cavenx.com

General inquiries: hello@cavenx.com