Security & Compliance Overview

Tiwaar Academy follows a defense-in-depth security approach. All platform data is transmitted over TLS-encrypted channels and stored encrypted at rest. Access to production systems is restricted to authorized personnel using role-based access controls (RBAC) and multi-factor authentication (MFA).

The platform is built on a managed cloud infrastructure that is SOC 2 Type II compliant. Authentication, authorization, and session management are handled by built-in security services that follow OWASP best practices.

Academy data is multi-tenant isolated — each academy's data is segregated using row-level security (RLS) policies enforced at the database layer. One academy cannot access another academy's student, course, or financial data under any circumstance.

Tiwaar Academy maintains a vulnerability management process that includes:

• Dependency monitoring: All third-party dependencies are tracked and monitored for known CVEs. Critical vulnerabilities are patched within 72 hours of disclosure.
• Platform-managed patching: The underlying cloud infrastructure is managed and patched by our infrastructure provider, including OS-level security updates and runtime environment patches.
• Secrets management: All API keys, OAuth credentials, and webhook signing secrets are stored in encrypted secrets vaults — never in source code or client-side code.
• Responsible disclosure: Security researchers can report vulnerabilities to support@tiwaar.com. We acknowledge reports within 48 hours and remediate valid issues promptly.

Data is retained for as long as an academy account is active. Academy owners may request export or deletion of their data at any time via support@tiwaar.com.

• Encryption at rest: All database records and file storage are encrypted.
• Encryption in transit: All network traffic uses TLS 1.2+ with strong cipher suites.
• OAuth tokens: Zoom and payment provider OAuth tokens are stored server-side only, encrypted, and never exposed to the frontend.
• Payment data: No credit card or payment instrument data is stored by Tiwaar. All payment processing is handled by PCI-compliant providers (Stripe, Razorpay).
• Deletion: Upon account deletion, all associated academy data is permanently removed within 30 days, except where retention is required by law.

Full details are available in our Privacy Policy.

Tiwaar Academy follows a structured incident response process:

• Detection: Platform-level monitoring and alerting are provided by our cloud infrastructure. Anomalous activity, failed authentication spikes, and API abuse are automatically flagged.
• Assessment: Incidents are classified by severity (Critical, High, Medium, Low) based on data sensitivity and scope of impact.
• Containment: Compromised credentials or tokens are immediately revoked. Affected academy accounts may be temporarily suspended to prevent further impact.
• Notification: Affected academy owners are notified within 72 hours of a confirmed data breach. Integration partners (e.g., Zoom) are notified if the incident affects their integration.
• Post-incident review: All incidents are documented and reviewed to improve prevention measures.

Tiwaar Academy is hosted on a managed cloud platform. Infrastructure management responsibilities are shared:

• Platform-managed: Server provisioning, OS patching, runtime updates, database backups, DDoS protection, and network security are handled by our SOC 2 compliant cloud infrastructure.
• Application-managed: Tiwaar manages application-level code, OAuth integration logic, webhook handlers, and frontend dependencies. All application code is version-controlled.
• Dependency updates: Frontend and backend dependencies are reviewed monthly and updated to the latest stable versions. Security-critical updates are applied immediately.
• Webhook security: All incoming webhooks (Zoom, Stripe, Razorpay, LiveKit) are verified using cryptographic signature validation before processing.

Tiwaar Academy's underlying infrastructure is SOC 2 Type II compliant. This covers the security, availability, and confidentiality trust service criteria. Tiwaar Academy inherits these controls as a tenant of the platform.

SOC 2 compliance is maintained by the infrastructure provider through annual third-party audits. Tiwaar Academy's application-level security controls (data isolation, OAuth token management, webhook verification) are designed to align with SOC 2 control objectives.

Tiwaar Academy is not currently ISO 27001 certified. However, our security practices are designed to align with ISO 27001 control objectives, including access control (A.9), cryptography (A.10), operations security (A.12), and information security incident management (A.16). We are evaluating formal ISO 27001 certification as part of our growth roadmap.

The Tiwaar Academy Zoom integration follows Zoom's security best practices:

• OAuth 2.0: Academy owners connect Zoom via standard OAuth 2.0 authorization code flow. No Zoom credentials are stored — only short-lived access tokens and refresh tokens.
• State parameter signing: OAuth state parameters are HMAC-SHA256 signed to prevent CSRF/forgery attacks.
• Token storage: Zoom OAuth tokens are stored encrypted in the database with row-level security. Tokens are never exposed to the frontend or client-side code.
• Webhook verification: All Zoom webhook events are verified using the webhook signing secret token before processing.
• Minimal scopes: Only the minimum required Zoom scopes are requested: meeting:write, meeting:read, and user:read.
• Token rotation: Access tokens are automatically refreshed before expiry using the refresh token flow.