Back to Home
Security

Security

Last Updated: 21 August 2026

Our Approach to Security

Security is built into GrantPanda products from the start — not added as an afterthought. This page describes the security controls implemented across the GrantPanda platform and products.

We describe only controls that are actually implemented. We do not claim certifications or compliance frameworks that have not been formally audited and verified.

Security Controls

Transport Security
  • All GrantPanda web properties are served exclusively over HTTPS with TLS encryption
  • HTTP connections are redirected to HTTPS
  • Secure cookies are set with appropriate flags (HttpOnly, Secure, SameSite)
Authentication
  • User passwords are hashed before storage using a strong one-way hashing algorithm — plain text passwords are never stored or logged
  • Session tokens are generated with cryptographically secure randomness
  • Session expiry is enforced; stale sessions are invalidated
Authorisation and Access Control
  • Role-based access control (RBAC) is implemented across ICSB — students, parents, HODs, admins, and super-admins each have distinct permission scopes
  • Users can only access data within their authorised scope
  • Administrative actions are restricted to accounts with explicit admin roles
Data Isolation
  • In multi-institution ICSB deployments, institutional data is logically isolated — institution A cannot access institution B's data
  • Tenant boundaries are enforced at the application layer on every data query
Secrets and Credential Handling
  • API keys, tokens, and credentials are stored in environment variables and secrets management — never hardcoded in source code
  • Third-party service credentials (including WhatsApp Business Platform tokens) are scoped to the minimum necessary permissions
Database Security
  • Database access is restricted to application-layer services — no direct public internet access to the database
  • Parameterised queries are used to prevent SQL injection
  • Sensitive fields (passwords, tokens) are never stored in plain text
Webhook and API Security
  • Incoming webhooks (including WhatsApp Business Platform webhooks) are verified using signature validation before processing
  • API endpoints require valid authentication tokens; unauthenticated requests are rejected
Infrastructure
  • Production deployments run on Vercel's managed infrastructure, which provides DDoS mitigation, edge security, and uptime monitoring
  • Build and deployment pipelines are isolated from production credentials
Data Protection
  • Data in transit is encrypted via TLS
  • Data at rest encryption is provided at the infrastructure level by our hosting provider

Vulnerability Reporting

If you believe you have found a security vulnerability in any GrantPanda product, please report it responsibly. We ask that you:

  • Do not exploit the vulnerability or access data that does not belong to you
  • Report the issue to us privately before any public disclosure
  • Provide sufficient detail for us to reproduce and assess the issue

We will acknowledge receipt of your report promptly and work to address confirmed vulnerabilities as quickly as practicable. We will not take legal action against researchers who report issues in good faith following these guidelines.

Security Contactadnankhadnan@gmail.comSubject: "Security Vulnerability Report"

Limitations and Honest Disclosure

Security is an ongoing effort, not a finished state. We are a small technology team. While we implement the controls described on this page, we do not claim:

  • ISO 27001, SOC 2, or any formal certification
  • Formal penetration testing by an independent third party
  • Bug bounty programmes
  • Zero-downtime guarantees

We will update this page as our security posture evolves. If you have questions or specific security requirements for an institutional deployment, contact us to discuss.

Data Protection Context

Security controls work in conjunction with our data practices. For information about how data is collected, stored, shared, and deleted, see:

Contact

For security questions or to report a vulnerability:

H K Enterprises — GrantPandaadnankhadnan@gmail.com
contact@grantpanda.online