At a glance
- All traffic between your browser and LigiLearn uses HTTPS.
- Data is hosted in India, behind a firewall, with server access limited to a small number of authorised people.
- Passwords are stored as salted hashes, accounts lock after repeated failed sign-ins, and every user sees only what their role permits.
- Card and bank details never reach our servers.
1. Encrypted connections
LigiLearn is served over HTTPS using a TLS certificate issued by Let's Encrypt, and browsers are instructed to use HTTPS for every later visit. Data sent between your browser and LigiLearn is encrypted in transit.
2. Hosting and server access
- LigiLearn is hosted with Host IT Smart in a data centre in Gandhinagar (GIFT City), Gujarat, India.
- The servers sit behind a firewall.
- Server access is limited to a small number of authorised Ligimex personnel and is made over SSH.
- Each institute's data is kept separate from every other institute's data inside the application.
3. Application security
- Passwords: stored only as salted hashes, never in readable form.
- Sign-in protection: accounts lock for a period after repeated failed sign-ins, and sign-in and public forms are rate-limited.
- Sessions: sign-in sessions are short-lived and expire automatically.
- Role-based access: every role sees and does only what its permissions allow. Your administrator assigns roles and permissions.
- Audit log: changes to important records are logged with who made them and when.
4. Payments
Online payments are processed by Razorpay, which is PCI-DSS compliant. Card, UPI and bank details are entered on Razorpay's secure pages and are never stored by us. We keep only the payment reference and status.
5. Backups and your data
- Backups are taken every week and stored in India.
- You can export your data at any time, and we delete it after you leave as described in the privacy policy.
- The full list of providers that handle data on our behalf is on the data protection page.
6. Your responsibilities
Security is shared. We ask every institute to:
- choose strong passwords and not share accounts;
- deactivate accounts of staff who leave;
- give each person only the role and permissions they need;
- tell us promptly if an account may have been compromised.
7. If something goes wrong
If a personal data breach occurs, we act promptly to contain it. We inform the affected institute without undue delay, and in any case within 72 hours of becoming aware of the breach, with the facts known and the steps being taken. We also support any notification required under the DPDP Act. More detail is in the data protection page.
8. Report a security concern
If you believe you have found a security problem, please email info@ligimex.in with the subject "Security report" and describe what you found.
- We acknowledge reports within 2 working days.
- Please do not access, change or download data that is not yours, and give us reasonable time to fix the issue before sharing it publicly.
Phone: +91 90263 45448, Monday to Saturday, 9 AM to 7 PM IST.