Demo

Trust centre

How we protect your data

Plain answers for management, and a control-by-control view for your IT team. Our products are built differently, so each has its own section. We say what is built and what is still in progress.

I run a college I run a company

For colleges and universities

Tuling ERP

The college ERP: HR, students, fees, campus operations and the library.

  • Your data stays yours

    Each college gets its own subdomain and its own dedicated database, not a shared table with other colleges.

  • Your data stays in India

    Production runs on India-region cloud infrastructure, so student records, payroll, fees and documents stay in the country.

  • You can recover from a bad day

    Databases are backed up automatically, with point-in-time recovery, so a failed disk does not hold up examinations, payroll or fee cycles.

  • The right people see the right things

    Staff get the screens for their role and campus. A registrar on one campus cannot open another campus's fee waivers.

  • Every important change is recorded

    Compensation changes, leave approvals, fee waivers, access grants and payroll runs leave a record of who did what, and when.

  • Privacy law is part of the product

    Consent, data requests and retention are built in for the DPDP Act, alongside the POSH and statutory payroll tools.

Controls for your IT team (12)
Tenant isolation A dedicated PostgreSQL database and subdomain per institution, not shared-schema multi-tenancy.
Data residency India-region cloud hosting for production workloads.
Backups and recovery Automated database backups with point-in-time recovery options.
Role-based access (RBAC) Staff map to role portals, with module access limited to what the college licensed.
Permission claims Fine-grained permissions on top of roles, so a sensitive action stays locked until it is granted.
Attribute-based policies (ABAC, PBAC) Policies check campus, ownership, device and session before allowing an action. Explicit deny wins, and default is deny.
Risk-adaptive access (RAdAC) Unusual sign-ins, such as a new device, can trigger a step-up check or be refused.
Just-in-time access (JIT) Time-boxed temporary access for one action, approved by a second person and expiring on its own.
Separation of duties (SoD) Maker and checker are different people for money, accreditation packs and elevated access.
Session assurance Step-up challenges, such as an authenticator code, for sensitive or high-risk actions.
Audit logs Sensitive actions record who, what and when.
Encryption in transit TLS protects data in transit, and secrets are stored using platform secret management.

Where we stand

  • DPDP Act Built into the product Consent, purpose limitation, data requests and retention controls.
  • POSH Built into the product Case register and restricted workflow for the Internal Complaints Committee.
  • Statutory payroll Built into the product PF, ESI, professional tax and TDS, with statutory exports.
  • NAAC self-study report Built into the product A workspace for criteria, evidence and dual-control review.
  • ISO 27001 In progress We are working towards certification and do not claim it today.

Built into the product means the tools exist in the software. It does not replace your own policies or an auditor's opinion.

Read the full technical detail

For companies

Tuling HRMS

HR, attendance and payroll for Indian companies. It is a separate product with its own setup.

  • People see only what they should

    Employees see their own data, managers their team's, and HR what HR needs. Admins set roles for the company.

  • Sign-in is verified

    Sign-in needs a verified work email. Personal and temporary email addresses are not accepted.

  • Every change leaves a record

    Sensitive actions leave a record, including a read-only trail of sign-ins and failed attempts.

  • Complaints stay confidential

    POSH and grievance complaint details stay confidential.

  • Employees have rights over their data

    Employees can read the privacy notice, give or withdraw consent, download a copy of their data, correct details, erase optional data and raise a complaint.

  • Breaches are flagged

    Open breaches are flagged for reporting within 72 hours, with the Data Protection Officer's details at hand.

Controls for your IT team (8)
Hosting in India The application and its database run on cloud servers in Mumbai. Uploaded documents are stored on AWS in the Mumbai region. AWS's ISO/IEC 27001 and SOC 2 certificates are AWS's, not Tuling's.
Encryption in transit Every connection uses HTTPS with TLS 1.2 or newer. Older protocols are switched off, and browsers are told to always use HTTPS.
Firewalled servers Only the web ports are open to the internet. Repeated failed sign-in attempts to the server are blocked automatically.
Separate company data Each company's data is kept apart inside the system, and access depends on role.
Access by role Employees, managers and HR each see what their role needs.
Audit trail A read-only trail of sensitive actions, sign-ins and failed attempts.
Monitoring The platform is monitored automatically for failures and errors, and alerts go to our team.
Backup and audit export On the Scale plan: daily backup with retention, restore on request, and export of the audit trail as a CSV file.

Where we stand

  • DPDP tools Built into the product Privacy notice, consent, data download, correction and erasure of optional data.
  • POSH Built into the product Committee tools with confidential complaints.
  • Statutory payroll Built into the product PF, ESI, professional tax and TDS, with rates following the current rules and a history of every change.
  • ISO 27001 In progress We are working towards certification and do not claim it today.

Built into the product means the tools exist in the software. It does not replace your own policies or an auditor's opinion.

See the HRMS security page

Other apps

Tuling CRM and Tuling LMS

These are separate apps that connect to the ERP, and they keep their own records. Their security details are covered in the security pack, so we do not apply the ERP's claims to them here.

Request the security pack

Documents

Read and request

Tuling HRMS, for companies

The HRMS has its own published legal documents.

For the college ERP, we provide the data processing agreement and sub-processor list with the security pack.

Filling in a vendor questionnaire?

Send it to sales@tulingcreativehub.com. To report a security concern, write to support@tulingcreativehub.com.

Request the security pack