Polaris/Security

Built for the files you'd lose sleep over.

Agencies hold passports, bank statements, family incomes and visa histories. Polaris is built so that only the right person in the right agency ever sees them, and so you can prove it.

The right access for each role

Owners, head counsellors, counsellors and viewers. Counsellors see the students allocated to them.

Two-factor sign-in

Authenticator codes for every account, and owners can make them mandatory for the whole team.

Encrypted, end to end of the stack

Encrypted in transit, and documents and sensitive details encrypted at rest. Download links expire in minutes.

A record nobody can quietly edit

Every read, file opened and sign-in is logged from day one, in a tamper-evident trail owners can export.

Students' rights, built in

Export everything held about a student, or erase it across their file, documents and messages.

Consent before every message

WhatsApp and email reach only students who opted in, never during quiet hours, never twice.

AI and your data

Your students are not training data.

Rehnuma runs on Anthropic's Claude through its API, and data sent that way isn't used to train their models. It only ever reads students the person asking may see, and one student's conversation can't reach another's file.

What an agent may do
Read public university and government pagesYes
Propose facts, tasks and messagesYes
Change a file without a counsellor's tickNo
Pay, submit or solve a CAPTCHANo
How we build

Security is a release requirement, not a feature.

Isolation and access checks run before every release. Dependencies are scanned for known vulnerabilities, every response carries strict browser security headers, and sign-in is rate-limited against guessing.

Asking for a security review?

We'll walk your IT or compliance lead through access, logging and data handling on a call, and answer your questionnaire in writing.

Request a security call

Report a vulnerability

Found something? Tell us first.

Email inquire@polarisedu.info with "Security" in the subject line. We'll acknowledge within two working days and keep you updated until it's fixed. Details are in our security.txt.