Security Overview
AINOW EduOS is architected with a strict security-first paradigm. Educational institutions handle highly sensitive data, including student Personally Identifiable Information (PII), NRIC/FIN identification numbers, academic performance records, family contact details, and financial transactions.
Our defense-in-depth model enforces continuous zero-trust authorization across every microservice, API endpoint, and AI agent worker. Data access is strictly limited based on tenant identity and least-privilege role permissions.
Full cryptographic isolation for student records, family details, and identification credentials.
Tamper-evident PayNow UEN & GIRO billing records with full reconciliation audit trails.
Biometric & QR check-in logs stored securely with immutable access timestamp logging.
Infrastructure Security
All AINOW EduOS production infrastructure is deployed exclusively within the Amazon Web Services (AWS) Singapore Region (ap-southeast-1), guaranteeing low latency and data residency within Singapore jurisdiction.
- VPC Network Isolation: Production databases and backend services operate inside isolated private subnets with no public internet ingress.
- Multi-AZ High Availability: Application clusters are distributed across multiple Availability Zones in Singapore to withstand data centre outages.
- AWS WAF & Shield: Real-time Web Application Firewall rules filter malicious traffic, SQL injection attempts, and automated bot attacks.
- DDoS Protection: Global CloudFront edge distribution with AWS Shield Advanced mitigation against layer 3/4/7 DDoS attacks.
Data Encryption Standards
AES-256 Encryption at Rest
AWS RDS PostgreSQL & AWS S3 Storage
All database volumes, document attachments, OCR-scanned physical worksheets, and automated backups are encrypted using hardware-backed AES-256 cryptographic standards. Master keys are stored and automatically rotated via AWS Key Management Service (KMS).
TLS 1.3 Encryption in Transit
Strict Transport Security (HSTS)
100% of data exchanged between parent browsers, mobile devices, tutor portals, and backend APIs is secured using TLS 1.3 with Perfect Forward Secrecy (PFS). Unencrypted HTTP requests are automatically upgraded and legacy SSL/TLS versions are disabled.
AINOW EduOS utilizes envelope encryption for multi-tenant data storage. Each institution tenant is assigned unique data encryption keys (DEKs) encrypted under root keys managed in AWS KMS. Access to decryption keys is strictly bounded by backend IAM authentication policies.
Authentication & Access Control (RBAC)
TOTP Authenticator & Passkeys for all Admin & Staff accounts.
JWT tokens stored in Secure, SameSite=Strict HTTP-only cookies.
OAuth 2.0 & SAML 2.0 Enterprise SSO (Google, Azure AD, Okta).
Automatic timeout on inactivity & instant single-click revocation.
6-Role Granular Access Hierarchy
Full system configuration, global tenant provisioning, system audit logs, and security policy management.
Branch manager access, staff onboarding, financial approvals, timetable publishing, and institution settings.
Classroom roster management, homework grading, attendance taking, and parent report generation.
Lead enquiry logging, student check-ins, counter billing processing, and parent reception interactions.
View child academic progress, MOE report cards, fee invoice payments via PayNow, and direct teacher messaging.
Access personal timetable, submit digitized homework, review practice assessments, and view attendance.
Multi-Tenant Data Isolation
Row-Level Security (RLS)
Database queries automatically append tenant identification filters at the database engine layer. Even in multi-tenant shared tables, a customer can never query or mutate another centre's data.
Enterprise Schema Isolation
Growth and Enterprise tier institutions enjoy dedicated database schema segregation or isolated RDS instances, providing complete physical data boundaries and independent backup schedules.
Subdomain Routing Boundaries
Requests routed through tenant subdomains (academy.ainow.edu.sg) pass through edge validation middleware that verifies cryptographic tenant session claims before handling API requests.
AI Agent Security & Autonomy Controls
AINOW EduOS features 9 Autonomous AI Agents handling tasks like lead qualification, timetable scheduling, fee calculation, and homework inspection. To ensure absolute safety, every agent operates within tight security boundaries.
Actions involving fee modifications, bulk messaging, or student enrollment changes require explicit human supervisor approval before execution.
Every LLM prompt, agent output, confidence score, and human override decision is logged in an immutable audit ledger with timestamps.
Tenant data is never used to fine-tune shared global models. AI contexts are dynamically isolated per customer session.
Configurable Autonomy Spectrum
AI generates suggestions (e.g. invoice drafts). Human clicks approve for every single action.
AI executes within strict threshold limits (e.g. auto-booking trial classes under $50).
AI autonomously handles routine workflows while notifying admins via real-time activity feeds.
Singapore Regulatory & Compliance Framework
PDPA 2012 Compliant
Singapore Data ProtectionStrict personal data protection act alignment, explicit consent mechanisms, right to erasure, and zero unauthorized PII disclosure.
MOE Guidelines
Ministry of EducationStructured student record handling, tutor accreditation tracking, and MOE-aligned grading report templates.
EduTrust & ERF Support
Private Education FrameworkBuilt-in support for CPE registration, student contract verification, and regulatory quality assurance standards.
Fee Protection Scheme (FPS)
Escrow Ledger IntegrationAutomated student tuition fee protection logs, insurance escrow reporting, and audited transaction ledgers.
Application Security & Hardening
Continuous protection against injection attacks, broken authentication, sensitive data exposure, and security misconfigurations.
Strict type validation and sanitization on 100% of API endpoints using Zod schema enforcement before request execution.
Strict Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy HTTP response headers.
ORMs with strictly parameterized queries prevent raw SQL query concatenation and database injection vulnerabilities.
Automated React DOM escaping, Content-Security-Policy nonce enforcement, and SameSite cookie CSRF prevention tokens.
Dynamic IP and user account rate-limiting protecting login, password reset, and payment authorization endpoints.
Backup & Disaster Recovery (DR)
AINOW EduOS maintains an enterprise business continuity framework to ensure your tuition centre or academy operations never stall during unplanned outage events.
- Daily Snapshots & 30-Day Retention: Automated daily full database backups with continuous 30-day rolling point-in-time retention.
- Point-In-Time Recovery (PITR): Restore your entire institution ledger to any specific second within the last 30 days.
- Cross-AZ Replication: Synchronous database replication across multiple AWS Singapore Availability Zones.
Maximum target duration to restore full operational service.
Maximum potential data age lost in extreme emergency recovery.
Incident Response & Threat Monitoring
Automated continuous SIEM security monitoring scanning for anomalous traffic patterns, unauthenticated API bursts, or credential stuffing attempts.
Our dedicated Security Incident Response Team (SIRT) is on standby 24/7/365 with an SLA to acknowledge critical security events within 60 minutes.
Transparent Root Cause Analysis (RCA) and comprehensive remediation reports delivered to impacted institution leaders within 72 hours of incident resolution.
Audit Trail & Compliance Logging
Every data creation, read, update, or deletion operation across student profiles, gradebooks, fee payments, and staff permissions generates an immutable audit record.
AWS CloudWatch Log Ingestion
Logs are streamed to AWS CloudWatch with cryptographic hash signing to prevent log tampering or retrospective alteration.
12-Month Compliance Retention
System logs are retained active for 12 months for compliance reporting, PDPA audits, and MOE inspection exports.
Vulnerability Management & Penetration Testing
Annual third-party black-box and white-box penetration testing conducted by CREST-certified Singapore cybersecurity firms.
Automated continuous CI/CD pipeline scans (Snyk & Dependabot) detecting vulnerable open-source libraries before code deployment.
Critical vulnerability patches (CVSS 9.0+) are tested, hotfixed, and deployed within 24 hours of public CVE advisory disclosure.
Contact Security Team & Responsible Disclosure
If you believe you have discovered a potential security vulnerability in AINOW EduOS, or if your institution requires a custom security questionnaire / vendor assessment, please reach out directly to our security officer.
We welcome security researchers and provide safe harbor for responsible vulnerability disclosures.
Reports are reviewed and acknowledged within 24 hours.