Legal & Trust

Data Security and Responsible Disclosure

Last updated: 29 August 2026

Protecting student, family and school information is a shared responsibility. Exampay uses layered technical and operational controls and welcomes good-faith reports that help us improve.

Security controls

• authenticated, role-based access for administrators, schools, professors, students and parents;
• database row-level controls and security-definer functions with constrained search paths;
• private study-resource storage with short-lived, authorised download links;
• server-authoritative assessment start, expiry and submission validation;
• input, file and size validation; locally pinned frontend dependencies; and restrictive browser security headers;
• audit-oriented events, account suspension support and documented deployment checks.

No control eliminates all risk. Schools should maintain authorised-user lists, backups, retention schedules, staff training, incident contacts and independent checks of their production Supabase and hosting configuration.

Report a security issue

Email info@exampay.in with the subject “Security report”. Include the affected URL or feature, clear reproduction steps, likely impact, relevant timestamps and a safe way to contact you. Encrypt sensitive evidence where possible and do not include student data unless strictly necessary. Our machine-readable contact is available at /.well-known/security.txt.

Good-faith testing rules

• Test only accounts and records you own or have explicit written permission to use.
• Do not access, change, retain or disclose another person's data.
• Do not use denial-of-service, spam, social engineering, malware, destructive testing or automated high-volume scanning.
• Stop once you have enough evidence to report the issue. Preserve confidentiality while we investigate.
• Comply with applicable law and any written scope we provide.

This page is not a public bug-bounty offer and does not promise payment. We will make reasonable efforts to acknowledge a complete report, investigate it and communicate material progress. We ask reporters to allow a reasonable remediation period before any coordinated disclosure.

For suspected account compromise or a privacy incident

Sign out, secure the associated Google or email account, preserve relevant timestamps and contact both Exampay and the affected school immediately. Do not attempt to investigate by opening other users' records.

Security contact

Exampay, Berger Delhi One, Sector 16B, Noida, Uttar Pradesh 201301, India. Email: info@exampay.in. Phone: +91 97176 20933.