Security for schools, colleges and coaching institutes
An institution holds some of the most sensitive data there is: children's names, addresses, photographs, marks and parents' phone numbers. It also runs some of the busiest websites in the country on admissions and result days. Guardian keeps those portals available, watches the servers and computers behind them, and gives the principal or director a plain monthly picture of where things stand.
What an institution needs to protect
- Admissions portals that face floods of traffic and automated form abuse when applications open.
- Student and parent data: records, fee details, photographs, ID scans and contact numbers held in portals, exports and spreadsheets.
- Staff laptops that carry mark sheets, question papers and the admin login to everything.
- Exam papers and results, from the computer where they are typed to the page where they are published.
- The institution's email domain, which fee fraud and fake notices are sent from if it is not protected.
What we provide
- Website protection. Rate limits keep a results page or login form usable when demand spikes, the human check stops scrapers and bots, and managed rules refuse common web attacks before they reach older portals. Available now.
- Guardian Protocol. Every protected portal is served with post-quantum hybrid encryption for browsers that support it, so data recorded today stays protected. Available now.
- Linux server protection. A read-only agent watches the servers behind admissions and examination systems for suspicious sign-ins, new administrator accounts and unexpected changes. If you choose, it also counts personal data in exports and backups, without the values leaving your server. Available now.
- Windows computers. A read-only agent for staff laptops: updates, built-in antivirus, disk encryption, administrator accounts, remote access tools and backups, with a fix list for your administrator. On request.
- Domain protection. Registrar lock and expiry, DNSSEC, sender list and policy presence, newly issued certificates and lookalike domains for your institution's domain, with an alert when anything changes. Available now. The exact email records to add are on request.
- A monthly report and, on request, an organisation protection score, so management sees the trend without reading each finding.
The DPDP Act 2023, in plain words
The Digital Personal Data Protection Act 2023 applies to any institution that holds personal data in digital form. Three parts matter most to schools and colleges.
- Children's data. For a person under eighteen, the Act requires verifiable consent from a parent or guardian before processing their data, and it restricts tracking, behavioural monitoring and targeted advertising aimed at children. Keep the consent and keep it findable.
- Consent and purpose. Data collected for admission is for admission. Using it for anything else needs its own notice and consent, and a parent can withdraw consent. Know which files hold what and why.
- Breach notice. If personal data is lost or exposed, the institution must inform the Data Protection Board and the affected people. That is only possible if someone notices quickly and can say what happened.
How Guardian helps with those duties
Guardian does not make an institution compliant, and no tool can. It gives you the facts you need: where personal data sits on your servers (counts and locations, never the values), which laptops are not encrypted, who can sign in to what, and a timestamped record of what was observed when something goes wrong. The Data Protection Report lays those facts out against the Act's duties so your management and your legal adviser have something concrete to work from. Decisions remain yours.
Admissions and result days
The busiest days for an institution's website are also the days attackers and scrapers pay the most attention. Before a known date, your team can review rate limits on the busiest pages and confirm the human check is on. During the day, the console shows blocked traffic as it happens. If something unusual starts, under-attack mode raises protection with one click and can be switched off when the peak has passed.
Built for a small team
Most institutions have one IT person, or a vendor, and a lot of goodwill. Guardian is designed for that. Website protection is a DNS change, the server agent installs with one command, findings are written in plain language and every change is made by your own administrator from a fix list. Nothing Guardian installs can block, delete or take a system down.
Getting started
Run the free security check on your institution's website, then request protection. Our team verifies the institution and the people who will hold access. Once approved, a website can be protected the same day through a DNS change, and server protection starts as soon as your administrator installs the agent. Pricing is on request.
Questions
Can Guardian keep our results page up on result day?
Guardian absorbs floods and limits abusive traffic so more capacity is left for real students. Your own server still needs to handle real demand.
Does Guardian see student or parent data?
No. Personal data scans run on your own server and report counts and locations, never the values. Guardian keeps no copy of your pages or your users' data.
Does this make us compliant with the DPDP Act?
No tool can do that on its own. Guardian gives you the facts and a report laid out against the Act's duties. Compliance decisions remain with the institution.
Is this for coaching institutes as well as schools and colleges?
Yes. Any institution with public websites, portals, servers or staff computers can request protection.
Are staff laptops covered today?
The Windows agent is on request while it is being built. Website and Linux server protection are available now.