Security

Last updated 2026-10-28

This page explains how we protect the schools, teachers and students who use OneLMS. If you are a school and need a security questionnaire answered, write to our privacy contact at support@onelms.lk.

Where your data is kept

Our main database and our sign-in system run on Supabase in Seoul, South Korea.
The website and app servers run on Vercel, also in Seoul. Pages and images are delivered through Vercel’s global network.
Uploaded files (images, documents, videos and recordings) are stored on Cloudflare R2.
Supabase and Vercel both publish SOC 2 Type 2 and ISO 27001 reports for their services. The full list of the companies we use is on our sub-processors page.

Encryption

Every connection to OneLMS uses HTTPS, and browsers are told to use HTTPS only (HSTS).
The database and file storage are encrypted at rest by our hosting providers.
On top of that, we encrypt the most sensitive fields ourselves before they reach the database: national ID numbers, dates of birth and bank account numbers are sealed with AES-256-GCM when they are saved. Payment gateway keys and Zoom credentials that schools connect are encrypted the same way. The keys are kept in the server environment, never in the database.
Bank account fingerprints used to spot changes are keyed hashes, so they cannot be turned back into account numbers.

Keeping each school separate

Every record belongs to one school. Each request is checked on the server against the signed-in person’s school and role, so staff see only their own school’s records and students only their own classes and results. Row-level security rules in the database also block direct access to another school’s data.

Signing in

Passwords are stored only as salted hashes by our sign-in provider, never in readable form.
Teachers and school staff can turn on two-step sign-in with an authenticator app (TOTP) in Settings → Security. OneLMS administrators must use it.
Repeated failed sign-in attempts are slowed down and then blocked.
When our support staff view an account to help a school, that access is recorded in an audit log.

Backups

The database is backed up every night to two separate servers, away from the main hosting provider, on alternate nights. Each server keeps its newest 30 copies. Every backup is read back in full to check it is complete, a failed night raises an alert, and we have tested a full restore.

If something goes wrong

If we find or are told about a security incident that affects personal data, we:

contain it and find out what happened and whose data is involved;
tell every affected school without undue delay and within 48 hours of becoming aware of it, with what we know and what we are doing (as our Data Processing Addendum promises);
report it to the Data Protection Authority of Sri Lanka, and tell the people affected, where the law requires it, and help schools outside Sri Lanka meet their own reporting deadlines;
record the incident and what we changed so it does not happen again.

Report a security problem

If you think you have found a security weakness in OneLMS, please write to our privacy contact at support@onelms.lk with the details and how to reproduce it. Please do not access other people’s data, change data or disrupt the service while testing. We will reply, keep you informed, and fix confirmed problems as quickly as we can.

Panoralink Business Solutions (pvt) Ltd (PV 00286766)

Where your data is kept

Our main database and our sign-in system run on Supabase in Seoul, South Korea.

The website and app servers run on Vercel, also in Seoul. Pages and images are delivered through Vercel’s global network.

Uploaded files (images, documents, videos and recordings) are stored on Cloudflare R2.

Supabase and Vercel both publish SOC 2 Type 2 and ISO 27001 reports for their services. The full list of the companies we use is on our sub-processors page.

Encryption

Every connection to OneLMS uses HTTPS, and browsers are told to use HTTPS only (HSTS).

The database and file storage are encrypted at rest by our hosting providers.

On top of that, we encrypt the most sensitive fields ourselves before they reach the database: national ID numbers, dates of birth and bank account numbers are sealed with AES-256-GCM when they are saved. Payment gateway keys and Zoom credentials that schools connect are encrypted the same way. The keys are kept in the server environment, never in the database.

Bank account fingerprints used to spot changes are keyed hashes, so they cannot be turned back into account numbers.

Keeping each school separate

Signing in

Passwords are stored only as salted hashes by our sign-in provider, never in readable form.

Teachers and school staff can turn on two-step sign-in with an authenticator app (TOTP) in Settings → Security. OneLMS administrators must use it.

Repeated failed sign-in attempts are slowed down and then blocked.

When our support staff view an account to help a school, that access is recorded in an audit log.

If something goes wrong

If we find or are told about a security incident that affects personal data, we:

contain it and find out what happened and whose data is involved;

tell every affected school without undue delay and within 48 hours of becoming aware of it, with what we know and what we are doing (as our Data Processing Addendum promises);

report it to the Data Protection Authority of Sri Lanka, and tell the people affected, where the law requires it, and help schools outside Sri Lanka meet their own reporting deadlines;

record the incident and what we changed so it does not happen again.

Report a security problem

Panoralink Business Solutions (pvt) Ltd (PV 00286766)