Security at Every Layer
OrvexCore is built for institutions that handle sensitive student and financial data. Every layer of the platform — from database to API to authentication — is hardened by design, not bolted on later.
Encryption
AES-256 encryption for all data at rest
TLS 1.3 for all data in transit
Database-level field encryption for sensitive PII
Encrypted backups with key rotation
Access Control
Role-based access control (RBAC) on every endpoint
Multi-factor authentication for administrator accounts
Session expiry and remote session revocation
IP allowlisting for enterprise accounts
Audit & Logging
Immutable audit log for every financial action
Actor, timestamp, and context recorded per event
Log retention for 7 years (compliance grade)
Exportable audit reports for external auditors
Data Isolation
Full multi-tenant data isolation per organisation
Schema-level separation prevents cross-tenant access
Row-level security on all database tables
API request validation against organisation context
Infrastructure
Containerised workloads with isolated network namespaces
Infrastructure-as-code with immutable deployments
Automated vulnerability scanning in CI/CD pipeline
Dependency audits on every build
Compliance
NDPR (Nigeria Data Protection Regulation) alignment
GDPR-ready data handling and deletion workflows
FERPA-aligned student record protections
SOC 2 Type II controls implementation in progress
NDPR Aligned
GDPR Ready
FERPA Aligned
SOC 2 In Progress
AES-256
TLS 1.3
Need a Data Processing Agreement?
OrvexCore provides a signed DPA for enterprise and regulated institution customers. Contact us to request one.