TaraAll policies

Policy

Security & Disclosure

Last updated 31 July 2026

In short

Data is encrypted in transit and at rest, PINs are stored only as hashes, and homework images are never publicly readable.

Found a flaw? Email us. We will not pursue you for reporting it in good faith.

How we protect data

  • In transit: TLS 1.2 or better everywhere, with HSTS, and plain HTTP redirected to HTTPS.
  • At rest: encrypted storage volumes and encrypted backups.
  • PINs:stored only as salted hashes. Nobody at our end can read a child’s PIN, and it is never sent to the browser.
  • Homework images: held in private storage and served through short-lived signed links. There is no public URL to guess.
  • Access: production access is limited to named people and is logged.
  • Region: primary storage and AI processing run in India (AWS Mumbai).
  • Isolation:the AI has no ability to read one family’s data while helping another.

Reporting a vulnerability

Email complaints@aiwallah.com with SECURITY in the subject line. Please include what you found, how to reproduce it, and what you think the impact is.

Please do not post it publicly before we have had a chance to fix it.

What we promise

  1. We acknowledge within 2 working days.
  2. We give you an assessment and a rough timeline within 7 days.
  3. We tell you when it is fixed, and credit you publicly if you would like that.
  4. We will not take legal action against you for research carried out in good faith under the rules below.

Please do not

  • Access, modify or download any real child’s data. If you stumble onto someone’s data, stop and tell us immediately.
  • Run denial-of-service or high-volume automated testing.
  • Use social engineering against our staff or our users.
  • Test physical security at our registered office.

Create your own test account and use that. There is currently no paid bounty, but we are glad to credit you.

In scope

  • aiwallah.com and its subdomains
  • The Tara web application and its API

Findings we already know about and consider low priority: missing security headers on static assets, rate limits on unauthenticated endpoints being generous, and reports generated solely by an automated scanner with no demonstrated impact.

If something does go wrong

Should a breach affect personal data, we will notify the Data Protection Board of India and the affected parents as required under the Digital Personal Data Protection Act, 2023, and tell you plainly what happened and what to do about it.