Comprehensive documentation on how EdCon protects institutional and student data, meets global compliance standards, and ensures rock-solid reliability.
1. Regulatory Compliance & Laws (African Focus)
We believe that privacy is a fundamental human right. Our architecture is built from the ground up to comply with the strictest data protection laws across the African continent, ensuring that local institutions maintain full sovereignty over their data.
DPA (Zimbabwe)
Cyber and Data Protection Act (Zimbabwe)
EdCon adheres strictly to Zimbabwe's Data Protection Act. We guarantee that student and institutional data is processed lawfully, fairly, and transparently. Our Role-Based Access Control (RBAC) ensures that only authorized educators and administrators can access sensitive records, preventing unauthorized disclosure as mandated by the Act.
POPIA (South Africa)
Protection of Personal Information Act
We enforce strict compliance with South Africa's POPIA. Institutions and users own their data absolutely. EdCon provides automated tools for data access, correction, and the right to erasure. We ensure that all processing conditions—including accountability, processing limitation, and security safeguards—are met comprehensively.
DPA (Kenya)
Data Protection Act (Kenya)
In alignment with Kenya's DPA, we prioritize the protection of personal data, especially concerning minors. We do not track, profile, or sell student data. Parental consent workflows are deeply integrated, and we uphold the principles of data minimization and storage limitation across all our databases.
2. Infrastructure & Application Security
Data is protected at every layer of the technology stack, ensuring that unauthorized access is physically and mathematically impossible.
End-to-End Encryption: All data transmitted between the user's browser and our servers is secured using TLS 1.3. Data at rest (stored in our databases) is encrypted using industry-standard AES-256.
Authentication & Passwords: Passwords are never stored in plain text. We utilize bcrypt hashing with computationally expensive work factors to protect credentials against brute-force attacks.
Session Security: Authorized sessions are managed via short-lived JSON Web Tokens (JWTs) stored in secure, HttpOnly cookies, rendering them immune to Cross-Site Scripting (XSS) attacks. CSRF tokens are enforced on all mutating requests.
3. Resilience & Availability
Education shouldn't stop because a server failed. We guarantee 99.99% uptime through distributed, redundant systems.
Daily Automated Backups: Point-in-time recovery (PITR) ensures that even in catastrophic scenarios, data can be restored to any second within the last 35 days. Backups are geo-replicated across multiple availability zones.
Immutable Audit Logs: Every critical action taken by an administrator or teacher (such as changing grades, deleting files, or modifying permissions) is cryptographically recorded in an append-only audit log to prevent tampering and ensure full accountability.
Rate Limiting & DDoS Protection: Our network edge mitigates Distributed Denial of Service (DDoS) attacks automatically, while application-level rate limiting prevents API abuse.
4. Data Ownership & Sharing
The business model of EdCon relies on providing the best educational software, not selling user data.
No Third-Party Selling: We do not—and will never—sell, rent, or lease student or teacher data to third parties, marketers, or data brokers.
Vendor Security: Any third-party infrastructure providers we use (such as AWS or Google Cloud) are strictly audited and bound by Data Processing Agreements (DPAs) that reflect our uncompromising security standards.