Two layers of identity verification
Every login is verified. No one can access the app by guessing. Every user must prove who they are.
Mobile OTP Login
Users sign in using their registered phone number. A one-time password is sent via SMS, valid for a single session only.
Admin PIN (2FA)
After OTP login, admins must enter a private 4-digit PIN. Five wrong attempts automatically signs them out.
Password Rules
Email login passwords require a minimum of 6 characters, at least one capital letter, and a number or symbol.
Powered by Firebase Auth
The same authentication infrastructure used by millions of Google apps, battle-tested and enterprise-grade.
Every user sees only what they should
Role-based access is enforced on the server, not just hidden in the app. Even if someone tried to bypass the UI, the database would reject the request.
| Data | Admin | Teacher | Parent / Student |
|---|---|---|---|
| All students | ✓ Full | ✓ Read | ✗ Own child only |
| Attendance | ✓ Full | ✓ Mark & view | Own child only |
| Exam marks | ✓ Full | ✓ Enter & view | Own child only |
| Fee records | ✓ Full | ✗ No access | Own child only |
| Staff profiles | ✓ Full | Own profile only | ✗ No access |
| Audit logs | ✓ Full | ✗ No access | ✗ No access |
| School notices | ✓ Full | ✓ Post & view | ✓ Read only |
Encrypted storage and safe payments
Your school's data is stored securely on Google Cloud and payments are handled by a certified gateway. CampZa never sees card details.
Hosted on Google Cloud
All data is stored on Google Firebase infrastructure with industry-leading reliability, uptime guarantees and physical security.
Encrypted in Transit
All communication between the app and our servers uses HTTPS/TLS encryption. Data cannot be intercepted.
Razorpay Payments
Fee payments go through Razorpay, a PCI-DSS Level 1 certified gateway. CampZa never stores card or bank details.
Google Infrastructure
Firebase is ISO 27001, SOC 1, SOC 2, and SOC 3 certified, the same infrastructure used by Google's own products.
Full Audit Trail
Every key action in the app (attendance marked, marks entered, fees created, students added) is logged with a timestamp and the name of the person who did it. School admins can review the complete history at any time from within the app.
Security at a glance
- Mobile OTP authentication, no passwords to steal or forget
- Admin 4-digit PIN as a second factor after login
- Server-side security rules, with access control enforced at the database level
- Each user sees only their own data. Parents cannot see other students
- All data stored in Mumbai on Google Firebase infrastructure
- Data encrypted at rest and in transit (HTTPS/TLS)
- Payments via Razorpay, PCI-DSS certified, no card data stored by CampZa
- Full audit log of all admin and teacher actions
- Automatic sign-out after 5 failed PIN attempts
- File uploads stored in Firebase Storage with authenticated access only
We're happy to answer
If your school has specific security questions or requirements, reach out and we'll be glad to walk you through how CampZa protects your data.
Contact Us