Enterprise-Grade Security Architecture

AINOW EduOS Security Framework

Designed from the ground up to safeguard sensitive education data, student PII, financial ledgers, and academic records across Singapore tuition centres, enrichment academies, and private education institutions.

Hosting Region
AWS SG (ap-southeast-1)
Data Encryption
AES-256 & TLS 1.3
Compliance
PDPA 2012 & MOE
Disaster Recovery
RTO: 4h | RPO: 1h
Last updated: 25 July 2026
Section 1

Security Overview

AINOW EduOS is architected with a strict security-first paradigm. Educational institutions handle highly sensitive data, including student Personally Identifiable Information (PII), NRIC/FIN identification numbers, academic performance records, family contact details, and financial transactions.

Our defense-in-depth model enforces continuous zero-trust authorization across every microservice, API endpoint, and AI agent worker. Data access is strictly limited based on tenant identity and least-privilege role permissions.

Student PII Protection

Full cryptographic isolation for student records, family details, and identification credentials.

Financial Ledger Defense

Tamper-evident PayNow UEN & GIRO billing records with full reconciliation audit trails.

Attendance & Logs

Biometric & QR check-in logs stored securely with immutable access timestamp logging.

Section 2

Infrastructure Security

All AINOW EduOS production infrastructure is deployed exclusively within the Amazon Web Services (AWS) Singapore Region (ap-southeast-1), guaranteeing low latency and data residency within Singapore jurisdiction.

  • VPC Network Isolation: Production databases and backend services operate inside isolated private subnets with no public internet ingress.
  • Multi-AZ High Availability: Application clusters are distributed across multiple Availability Zones in Singapore to withstand data centre outages.
  • AWS WAF & Shield: Real-time Web Application Firewall rules filter malicious traffic, SQL injection attempts, and automated bot attacks.
  • DDoS Protection: Global CloudFront edge distribution with AWS Shield Advanced mitigation against layer 3/4/7 DDoS attacks.
Datacenter Locationap-southeast-1
Primary DatacenterAWS Singapore Zone A
Failover DatacenterAWS Singapore Zone B & C
Network Latency< 12ms (within SG)
SLA Guarantee99.9% Uptime
* Zero data transfer outside Singapore borders without explicit customer authorization.
Section 3

Data Encryption Standards

At Rest

AES-256 Encryption at Rest

AWS RDS PostgreSQL & AWS S3 Storage

All database volumes, document attachments, OCR-scanned physical worksheets, and automated backups are encrypted using hardware-backed AES-256 cryptographic standards. Master keys are stored and automatically rotated via AWS Key Management Service (KMS).

Transit

TLS 1.3 Encryption in Transit

Strict Transport Security (HSTS)

100% of data exchanged between parent browsers, mobile devices, tutor portals, and backend APIs is secured using TLS 1.3 with Perfect Forward Secrecy (PFS). Unencrypted HTTP requests are automatically upgraded and legacy SSL/TLS versions are disabled.

Envelope Encryption & Key Management

AINOW EduOS utilizes envelope encryption for multi-tenant data storage. Each institution tenant is assigned unique data encryption keys (DEKs) encrypted under root keys managed in AWS KMS. Access to decryption keys is strictly bounded by backend IAM authentication policies.

Section 4

Authentication & Access Control (RBAC)

MFA Required

TOTP Authenticator & Passkeys for all Admin & Staff accounts.

HTTP-Only Cookies

JWT tokens stored in Secure, SameSite=Strict HTTP-only cookies.

SSO Integration

OAuth 2.0 & SAML 2.0 Enterprise SSO (Google, Azure AD, Okta).

Session Invalidation

Automatic timeout on inactivity & instant single-click revocation.

6-Role Granular Access Hierarchy

SuperAdminPlatform Level

Full system configuration, global tenant provisioning, system audit logs, and security policy management.

AdminInstitution Level

Branch manager access, staff onboarding, financial approvals, timetable publishing, and institution settings.

TeacherAcademic Level

Classroom roster management, homework grading, attendance taking, and parent report generation.

StaffFront-Desk Operations

Lead enquiry logging, student check-ins, counter billing processing, and parent reception interactions.

ParentGuardian Portal

View child academic progress, MOE report cards, fee invoice payments via PayNow, and direct teacher messaging.

StudentLearner Portal

Access personal timetable, submit digitized homework, review practice assessments, and view attendance.

Section 5

Multi-Tenant Data Isolation

RLS

Row-Level Security (RLS)

Database queries automatically append tenant identification filters at the database engine layer. Even in multi-tenant shared tables, a customer can never query or mutate another centre's data.

SCHEMA

Enterprise Schema Isolation

Growth and Enterprise tier institutions enjoy dedicated database schema segregation or isolated RDS instances, providing complete physical data boundaries and independent backup schedules.

DNS

Subdomain Routing Boundaries

Requests routed through tenant subdomains (academy.ainow.edu.sg) pass through edge validation middleware that verifies cryptographic tenant session claims before handling API requests.

Section 6

AI Agent Security & Autonomy Controls

AINOW EduOS features 9 Autonomous AI Agents handling tasks like lead qualification, timetable scheduling, fee calculation, and homework inspection. To ensure absolute safety, every agent operates within tight security boundaries.

Human-in-the-Loop Gates

Actions involving fee modifications, bulk messaging, or student enrollment changes require explicit human supervisor approval before execution.

Comprehensive AI Action Audit

Every LLM prompt, agent output, confidence score, and human override decision is logged in an immutable audit ledger with timestamps.

Zero Cross-Tenant Leakage

Tenant data is never used to fine-tune shared global models. AI contexts are dynamically isolated per customer session.

Configurable Autonomy Spectrum

Level 1
Manual Approval

AI generates suggestions (e.g. invoice drafts). Human clicks approve for every single action.

Level 2
Supervised Autonomy

AI executes within strict threshold limits (e.g. auto-booking trial classes under $50).

Level 3
Full Autonomy

AI autonomously handles routine workflows while notifying admins via real-time activity feeds.

Section 7

Singapore Regulatory & Compliance Framework

PDPA 2012 Compliant

Singapore Data Protection

Strict personal data protection act alignment, explicit consent mechanisms, right to erasure, and zero unauthorized PII disclosure.

MOE Guidelines

Ministry of Education

Structured student record handling, tutor accreditation tracking, and MOE-aligned grading report templates.

EduTrust & ERF Support

Private Education Framework

Built-in support for CPE registration, student contract verification, and regulatory quality assurance standards.

Fee Protection Scheme (FPS)

Escrow Ledger Integration

Automated student tuition fee protection logs, insurance escrow reporting, and audited transaction ledgers.

Section 8

Application Security & Hardening

OWASP Top 10 Defense

Continuous protection against injection attacks, broken authentication, sensitive data exposure, and security misconfigurations.

Input Sanitization & Zod

Strict type validation and sanitization on 100% of API endpoints using Zod schema enforcement before request execution.

CSP & Header Hardening

Strict Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy HTTP response headers.

SQL Injection Protection

ORMs with strictly parameterized queries prevent raw SQL query concatenation and database injection vulnerabilities.

XSS & CSRF Prevention

Automated React DOM escaping, Content-Security-Policy nonce enforcement, and SameSite cookie CSRF prevention tokens.

Rate Limiting & Brute-Force

Dynamic IP and user account rate-limiting protecting login, password reset, and payment authorization endpoints.

Section 9

Backup & Disaster Recovery (DR)

AINOW EduOS maintains an enterprise business continuity framework to ensure your tuition centre or academy operations never stall during unplanned outage events.

  • Daily Snapshots & 30-Day Retention: Automated daily full database backups with continuous 30-day rolling point-in-time retention.
  • Point-In-Time Recovery (PITR): Restore your entire institution ledger to any specific second within the last 30 days.
  • Cross-AZ Replication: Synchronous database replication across multiple AWS Singapore Availability Zones.
4 Hours
Recovery Time Objective (RTO)

Maximum target duration to restore full operational service.

1 Hour
Recovery Point Objective (RPO)

Maximum potential data age lost in extreme emergency recovery.

Section 10

Incident Response & Threat Monitoring

24/7 Monitoring

Automated continuous SIEM security monitoring scanning for anomalous traffic patterns, unauthenticated API bursts, or credential stuffing attempts.

<1 Hour Response SLA

Our dedicated Security Incident Response Team (SIRT) is on standby 24/7/365 with an SLA to acknowledge critical security events within 60 minutes.

72h Post-Incident Report

Transparent Root Cause Analysis (RCA) and comprehensive remediation reports delivered to impacted institution leaders within 72 hours of incident resolution.

Section 11

Audit Trail & Compliance Logging

Every data creation, read, update, or deletion operation across student profiles, gradebooks, fee payments, and staff permissions generates an immutable audit record.

AWS CloudWatch Log Ingestion

Logs are streamed to AWS CloudWatch with cryptographic hash signing to prevent log tampering or retrospective alteration.

12-Month Compliance Retention

System logs are retained active for 12 months for compliance reporting, PDPA audits, and MOE inspection exports.

Section 12

Vulnerability Management & Penetration Testing

Penetration Testing

Annual third-party black-box and white-box penetration testing conducted by CREST-certified Singapore cybersecurity firms.

Dependency Scanning

Automated continuous CI/CD pipeline scans (Snyk & Dependabot) detecting vulnerable open-source libraries before code deployment.

24h Patch SLA

Critical vulnerability patches (CVSS 9.0+) are tested, hotfixed, and deployed within 24 hours of public CVE advisory disclosure.

Section 13

Contact Security Team & Responsible Disclosure

If you believe you have discovered a potential security vulnerability in AINOW EduOS, or if your institution requires a custom security questionnaire / vendor assessment, please reach out directly to our security officer.

security@ainow.edu.sg

We welcome security researchers and provide safe harbor for responsible vulnerability disclosures.

Reports are reviewed and acknowledged within 24 hours.