Indian Sovereign Residency

Data Residency Notice

Effective: 16 July 2026Last Updated: 29 September 2026AWS Mumbai (ap-south-1)

Sovereign Storage Architecture

AWS Mumbai (ap-south-1)

All primary data is stored exclusively within India. Cloud infrastructure is hosted in AWS Mumbai (ap-south-1) with Supabase project region ap-south-1. Each Tenant operates a dedicated, isolated database instance with Row Level Security enforcement. ISO 27001, SOC 1, SOC 2, and SOC 3 certified data centres.

Cloud HostAWS ap-south-1

Database ModelDedicated Postgres + RLS

CertificationsISO 27001 • SOC 2

JurisdictionDPDP Act 2023 / India

This Data Residency Notice ("Notice") is issued by Grid Cohort ("Company," "we," "our," or "us") to inform all Users, Tenants (Schools/Institutions), Applicants, regulatory authorities, and stakeholders of the physical location, infrastructure specifications, jurisdictional scope, and sub-processor arrangements governing data storage and processing for the Cohort Educational ERP Suite (the "Software" or "Platform").

This Notice supplements, and shall be read in conjunction with, our Privacy Policy and Terms of Service.

1.Data Hosting Location

1.1. All primary data processed through the Software, including but not limited to personal data, institutional records, academic records, financial data, communication records, uploaded documents, media files, and application data, is stored exclusively on servers located within the territorial boundaries of the Republic of India.

1.2. Infrastructure Specifications:

Cloud Provider: Amazon Web Services, Inc. ("AWS")

AWS Region: Asia Pacific (Mumbai) — ap-south-1

Data Centre Location: Mumbai, Maharashtra, India

Supabase Project Region: ap-south-1 (Mumbai)

1.3. This infrastructure is operated by AWS in compliance with applicable Indian laws and regulations, and AWS maintains ISO 27001, SOC 1, SOC 2, and SOC 3 certifications for its Mumbai data centres.

2.Decentralised Tenant Database Architecture

2.1. The Platform operates on a decentralised, multi-tenant database architecture designed to provide the highest degree of data isolation between institutional subscribers (Tenants). The architecture comprises two layers:

(a)Central Database: Grid Cohort operates a centralised routing and orchestration database (the "Central Database") hosted within the ap-south-1 (Mumbai) region. The Central Database stores:

Tenant identifiers and slug references;

Tenant database connection metadata (URL, API keys);

Subscription status and billing metadata;

Central authentication routing information;

Community Platform forum posts, channels, and moderation data;

System configuration records (app version control, maintenance mode, pricing plans).

The Central Database does NOT contain institutional User personal data, academic records, financial records, or Tenant-specific institutional content beyond community forum participation data.

(b)Tenant Databases: Each Tenant is provisioned with a dedicated, isolated database instance (the "Tenant Database") hosted within the ap-south-1 (Mumbai) region. All User personal data, institutional records, academic records, financial data, audit logs, attendance records, chat messages, and all other operational data associated with a Tenant are stored exclusively within that Tenant's dedicated database.

2.2. Isolation Guarantee: No Tenant Database shares its infrastructure with any other Tenant's data. Row Level Security (RLS) policies are enforced at the database level within each Tenant Database to ensure that access is strictly scoped to authorised roles and users within that Tenant.

2.3. Connection Resolution: The mobile and web applications dynamically resolve and authenticate connections to the appropriate Tenant Database at runtime, using the Central Database's routing function. Connection credentials are stored securely on the user's device using device-level secure storage (iOS Keychain / Android Keystore via Expo SecureStore) and are not transmitted to any third party.

3.Scope of Data Residency

3.1. The following categories of data are stored within India (ap-south-1) in Tenant Databases:

(a)Authentication data (user accounts, encrypted credentials, session metadata, push notification device tokens);

(b)All personal data of Data Principals (students, parents, staff, administrators), including Identity Data, Contact Data, and Institutional Data;

(c)Institutional and academic records (academic years, classes, sections, timetables, attendance, grades, assessments, curriculum data);

(d)Financial records: (i) student fee structures, payment records, and transaction reference logs (stored in paise); (ii) staff salary structures, payroll disbursement records, bank account details for payroll, and reimbursement claim records (constituting SPDI under IT Rules 2011);

(e)Application data (admissions applications, career applications, enquiry records, and associated uploaded documents);

(f)Communication data: institutional announcements, notices, direct 1-on-1 chat messages (message body, media attachments, sticker/GIF references, sender identity, timestamp, read receipt status) between staff and parents/students, push notification payloads, and call session metadata;

(g)Transport data (route definitions, vehicle records, active trip logs, GPS location audit trails of transport personnel);

(h)Uploaded documents and files (leave application supporting documents, staff personal documents, expense receipts, reimbursement receipts, announcement attachments, syllabus documents, branding assets, task attachments, chat media attachments) — stored in Supabase Storage scoped to Tenant and Campus;

(i)Generated documents containing personal data (ID cards, academic certificates, fee payment receipts, payroll payslips) — stored in Supabase Storage where platform-retained;

(j)Discipline acknowledgement records (parent/guardian digital acknowledgements on discipline incident reports, timestamps, and acknowledgement status);

(k)Administrative task records (task assignments, subtasks, checklists, comments, attachments, audit trails, Kanban board state);

(l)Immutable Audit Logs;

(m)Gate pass records (pass type, validity, TOTP seeds, approval chain, escort details) and append-only Gate Movement Logs (checkpoint identity, movement direction, verification method, scanning guard identity, timestamps);

(n)Database backups and point-in-time recovery snapshots.

3.2. The following categories of data are stored within India (ap-south-1) in the Central Database:

(a)Tenant routing and connection metadata;

(b)Subscription and billing records;

(c)Tenant provisioning audit records;

(d)Community Platform forum data (posts, replies, channels, moderation status, author identifiers);

(e)System configuration records (app version configuration, maintenance mode state, pricing plan definitions).

4.Edge Functions and Serverless Compute

4.1. The Software utilises Supabase Edge Functions for specific server-side operations. These functions are deployed to and executed within the ap-south-1 (Mumbai) region.

4.2. Edge Functions include: tenant provisioning, admission application processing, career application processing, leave request management, fee payment processing, push notification orchestration, transport proximity notification, certificate generation, subscription billing, and onboarding step completion.

4.3. Edge Functions do not persistently store personal data and operate solely as transient compute processes within the ap-south-1 region.

5.Webrtc and Real-time Communication Infrastructure

5.1. Call Signalling: The Platform's peer-to-peer audio calling feature uses Supabase Realtime (hosted within ap-south-1, Mumbai) for call signalling — the exchange of connection setup information (SDP offers/answers) between callers and receivers. Call signalling metadata is processed and logged within the Tenant Database in India.

5.2. Peer-to-Peer Media: The actual audio content of calls is transmitted directly between the devices of the participants using WebRTC peer-to-peer technology. Audio data does NOT transit through Grid Cohort's servers, Supabase servers, or AWS servers at any point.

5.3. ICE Candidate Traversal — STUN: The WebRTC connection establishment process uses STUN (Session Traversal Utilities for NAT) servers to resolve network connectivity. Specifically, the Platform uses STUN servers operated by Google LLC (United States) — stun.l.google.com, stun1.l.google.com, and stun2.l.google.com — as the primary STUN infrastructure. During call setup, the device transmits a STUN binding request containing its source IP address and port to Google's STUN servers, which respond with the device's observed public IP address and port. This data is ephemeral — it is not retained by Google — and does not constitute personal data within the meaning of the DPDP Act, 2023.

5.4. Audio Relay — TURN (Fallback): Where a direct peer-to-peer audio connection cannot be established due to network conditions (for example, when both parties are behind symmetric NAT on mobile data networks), audio call traffic is relayed through a TURN (Traversal Using Relays around NAT) server operated by Open Relay (Metered.ca), a United States-based company, at the relay endpoint a.relay.metered.ca. In such cases, the encrypted audio stream transits through Metered.ca's relay infrastructure. Audio content relayed through the TURN server is encrypted in transit (using DTLS-SRTP). Metered.ca does not store, record, or inspect the content of any relayed call. TURN relay is a fallback mechanism that activates only when a direct peer-to-peer connection cannot be established.

5.5. No Recording: Grid Cohort does not record, store, or process the audio content of any call conducted through the Platform, whether transmitted peer-to-peer or via TURN relay.

5.6. Real-Time Data Subscriptions: The Platform uses Supabase Realtime for live data features (e.g., live transport tracking, real-time notifications, chat message delivery, and call signalling). All Realtime infrastructure for the Platform operates within the ap-south-1 (Mumbai) region.

6.No Cross-border Data Transfer of Personal Data

6.1. Grid Cohort does not transfer, mirror, replicate, or store personal data on servers located outside India for operational purposes.

6.2. The following cross-border data flows occur in the ordinary course of Platform operation involving third-party processors or infrastructure outside India:

(a)Push notification delivery: Expo push notification tokens and notification payload text are transmitted to Expo, Inc. (United States) for push notification delivery to User devices (see Section 7 — Sub-Processors).

(b)Transactional email delivery: When institutional email notifications are sent via the Brevo (Sendinblue SAS) API, recipient email addresses, names, email subjects, and sanitised HTML email body content are transmitted to Brevo's servers in France (European Union). Grid Cohort maintains a Data Processing Agreement with Brevo governing this cross-border transfer (see Section 7 — Sub-Processors).

(c)WebRTC STUN traversal: ICE candidate data (public IP address and NAT port binding) is transmitted to Google LLC STUN servers (United States) during voice call setup. This data is ephemeral and does not constitute personal data (see Section 5.3).

(d)WebRTC TURN relay (conditional): When direct peer-to-peer audio connection fails, encrypted audio is relayed through Open Relay (Metered.ca) TURN servers (United States). Audio content is not stored by Metered.ca (see Section 5.4).

(e)GIPHY API: GIF search queries (non-personally identifiable text) are transmitted to GIPHY, LLC (United States) for content retrieval. No User personal data is transmitted alongside search queries (see Section 7 — Sub-Processors).

(f)Anonymised, non-identifiable crash reports and performance telemetry processed by Expo's infrastructure outside India.

(g)Technical metadata transiting international network nodes in the ordinary course of internet routing.

6.3. In the event that the Central Government of India issues notifications under the DPDP Act, 2023 restricting or permitting cross-border transfers to specific jurisdictions, Grid Cohort shall comply with all such directives.

7.Sub-processors

7.1. Grid Cohort engages the following sub-processors in connection with the Platform. Each sub-processor is subject to a data processing agreement or equivalent contractual obligation with Grid Cohort:

7.2. AWS and Supabase: Both AWS and Supabase are US-incorporated entities. However, the data processing infrastructure utilised by Grid Cohort for the Platform is physically and logically located in India (ap-south-1). Supabase's control-plane operations (such as dashboard access, project management, and billing) and AWS's global management services may be processed on servers outside India, but such operations do not involve the processing or storage of User personal data.

7.3. Expo, Inc.: Expo is a US-incorporated company whose push notification service (Expo Push Service) is used to deliver notifications to User devices. Expo push notification tokens and notification payloads (which contain limited, non-sensitive notification text) are transmitted to Expo's servers for delivery to the target device. Expo's OTA update service may also transmit JavaScript bundle updates to User devices. Expo does not receive, process, or store User personal data beyond the push token and notification payload. Expo's data handling is governed by Expo's own privacy policy.

7.4. Razorpay Payments Private Limited: Razorpay is an Indian company regulated by the Reserve Bank of India. Payment processing data (including transaction identifiers and payment amounts) associated with Tenant fee collection and SaaS subscription billing is processed by Razorpay. Razorpay's handling of payment data is governed by Razorpay's own privacy policy and RBI regulations. Grid Cohort stores only transaction reference identifiers and payment status within the Tenant Database; full payment card details are never stored by Grid Cohort.

7.5. GIPHY, LLC: GIPHY is a US-incorporated company whose API is used to retrieve animated GIF content for Chat Services. Search query text is transmitted to GIPHY's servers for content matching. No personally identifiable information, User IDs, or institutional data is transmitted alongside search queries. GIPHY's data handling is governed by GIPHY's own Terms of Service and Privacy Policy.

7.6. Sub-Processor Changes: Grid Cohort reserves the right to add, remove, or replace sub-processors. Tenants and Users will be notified of material changes to the sub-processor list through updates to this Notice.

Sub-Processor	Country	Purpose	Data Transmitted
Amazon Web Services, Inc.	United States	Cloud infrastructure, compute, and storage hosting	Primary Tenant data stored exclusively in Mumbai, India (ap-south-1)
Supabase, Inc.	United States	Database, auth, Realtime messaging, storage, and Edge Functions	Primary Tenant data stored exclusively in Mumbai, India (ap-south-1)
Expo, Inc.	United States	Push notification delivery and OTA update distribution	Push token + notification payload text only; no sensitive personal data
Razorpay Payments Pvt. Ltd.	India	Payment gateway for fee collection and SaaS billing	Processed in India (RBI-regulated); Grid Cohort stores only transaction IDs
Brevo (Sendinblue SAS)	France (EU)	Transactional email delivery	Email address, name, subject, and sanitised body transmitted to EU; DPA in place
Google LLC	United States	STUN server for WebRTC call connection	Ephemeral IP and NAT port only; no personal data retained
Open Relay (Metered.ca)	United States	TURN relay for WebRTC (fallback)	Encrypted audio relayed in transit only; no content stored
GIPHY, LLC	United States	Animated GIF content retrieval for Chat	Search query text only; no PII transmitted

8.Data Sovereignty and Compliance

8.1. Grid Cohort's choice of data hosting within India is made in furtherance of:

(a)the Digital Personal Data Protection Act, 2023, and any rules, regulations, or notifications issued thereunder;

(b)the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;

(c)any directions or advisories issued by the Ministry of Electronics and Information Technology (MeitY), Government of India;

(d)any requirements imposed by the Data Protection Board of India, once constituted and operational.

8.2. Tenants (Schools/Institutions) may rely upon this Notice to demonstrate to their stakeholders, parents, regulatory auditors, and governing bodies that all personal data processed through the Cohort ERP Suite is stored and maintained on Indian soil within dedicated, isolated Tenant Databases.

9.Verification and Audit

9.1. Grid Cohort shall, upon reasonable written request by a Tenant (subject to appropriate confidentiality obligations and subject to the payment of any reasonable fees for such audit assistance), provide documentary evidence or certification confirming the data residency arrangements described in this Notice.

9.2. Grid Cohort reserves the right to change its cloud infrastructure provider or hosting region, provided that:

(a)data remains within the territorial boundaries of India at all times;

(b)Users and Tenants are notified of any such change at least thirty (30) days in advance;

(c)the change does not diminish the level of data protection afforded under this Notice.

9.3. Grid Cohort is not responsible for and makes no representation regarding the data residency or data handling practices of sub-processors beyond the contractual obligations imposed by Grid Cohort on such sub-processors.

10.Contact

Data Protection Office

privacy@gridcohort.com

Data residency and privacy queries

Grievance Officer

grievance@gridcohort.com

Personal data processing grievances

General Support

support@gridcohort.com

Data export and support requests

This Notice shall be governed by and construed in accordance with the laws of India. Any disputes arising under this Notice relating to data residency shall be subject to the exclusive jurisdiction of the courts located in Vaniyambadi, Tirupattur District, Tamil Nadu, India.