Security, Privacy & Procurement

Service levels and operational standards

Corporate and institutional programs are operated to the baseline reviewers expect of a managed learning platform: encrypted data, restricted access, monitored production services, and a named route for security and privacy questions.

Availability

IPGRAM production services run on Google Cloud Platform. Where a client prefers it, the program can also be deployed on Amazon Web Services or Microsoft Azure alongside Google Cloud. Services are run for continuous delivery through the scheduled life of a program. Applications operate in isolated environments. Maintenance that would interrupt a live cohort is planned outside peak learning hours where practicable, and the contracting organisation is told in advance.

Google Cloud, Amazon Web Services, and Microsoft Azure each publish availability commitments for the infrastructure services used on that platform. Those are the industry-standard hosting commitments underneath IPGRAM. A single public uptime percentage is not stated here, because the architecture of a program can differ. Where a review requires a monthly availability target, a recovery time objective, a recovery point objective, or service credits, those figures are confirmed in the program agreement for that deployment. The public learner terms describe individual access as provided on an as-available basis. They do not replace a service schedule agreed with a corporate or institutional customer.

Support during a contracted program

For an active corporate or institutional program, the Turnip program team is the point of contact for access, delivery, and operational issues. Severity definitions, response targets, and the escalation path are written into the program agreement, so IT and procurement have a timetable for that engagement.

These timings come from the published Privacy Policy and Terms. A program agreement can set a tighter operational target. It does not loosen a statutory duty.

Security by design

IPGRAM runs on Google Cloud Platform. A client that prefers Amazon Web Services or Microsoft Azure can have the program deployed on that platform alongside Google Cloud. The same technical and organisational safeguards protect platform and learner data on whichever platform is used. Security is applied in the architecture and in day-to-day operations. No method of transmission or storage is absolutely secure, and Turnip does not claim otherwise. The standard operated to is the highest practicable one described below.

Encryption

Data transmitted between users and Turnip systems is protected with industry-standard SSL/TLS. Data stored in IPGRAM databases is protected with encryption at rest. Passwords and sensitive credentials are stored with cryptographic hashing. They are not kept in a form that an administrator can read.

Access control

Access follows least privilege. Team members and services receive only the information required for their role or function. No single person or service is granted unrestricted access to the full set of user data. Access to sensitive data is logged and monitored. Internal access is reviewed regularly and removed when the role no longer requires it.

Infrastructure

Applications and services are designed to run in isolated environments, with access restricted on a need-to-know basis. Personal information sits behind secured networks and is available only to a limited number of authorised personnel. Turnip conducts periodic security assessments and vulnerability reviews, and updates its practices as threats and the platform change.

Privacy and data governance

Turnip Innovations Private Limited, the company behind IPGRAM, is the Data Fiduciary for personal data processed through its platforms under India’s Digital Personal Data Protection Act, 2023.

Processing is designed around the DPDP Act. Where Turnip processes personal data of people in the European Union or European Economic Area, GDPR requirements on lawful basis, data-subject rights, and cross-border transfer apply. California residents are afforded their CCPA rights, including the right to know, the right to delete, and the right to opt out of sale. Turnip does not sell personal information.

The legal bases used are consent, performance of a contract, legitimate interests such as platform security and fraud prevention where those interests do not override the individual’s rights, and compliance with law.

Turnip does not sell, rent, trade, or otherwise share personal data for marketing, advertising, or profiling. Learner databases, contact lists, and user data are not uploaded to advertising or social media platforms — including Google Ads, Facebook, Instagram, or similar services — for targeted advertising or lookalike campaigns.

Participant contact details stay with Turnip. IPGRAM does not share them with third parties, and does not pass them to the client, unless handing over that contact data is itself a stated deliverable of the program. Contact data may also be shared where a legal, compliance, or reporting obligation requires it. A provider that hosts the platform or sends the program email receives only the details needed for that function, and may not use them for its own purposes.

The public site at ipgram.in does not use cookies. Learning platforms described in the Privacy Policy use essential, analytics, and preference cookies, including Google Analytics with anonymisation, for aggregated usage statistics. That analytics data is not stored in Turnip’s own databases and is not linked to an individual learner record. Visitors can refuse analytics cookies through their browser or the Google Analytics opt-out add-on.

The platforms are not intended for children under 15. Turnip does not knowingly collect their personal data. A parent or guardian who believes a child has provided data can write to the Data Protection Officer and the data will be deleted.

What data does IPGRAM need?

The fields depend on the program. Collection is limited to what is required to deliver and operate that program. For most education programs this may include:

• learner name and email address;
• phone number, only when the learner submits it on an official form or a payment gateway requires it under Indian law;
• address and billing details, only for invoicing, a physical shipment if one exists, or a payment gateway — not as a default at registration;
• institution or organisation;
• course enrolment, progress, assessment, and completion records;
• certificates and credentials;
• content the learner creates and chooses to save;
• information the learner provides on a program form or survey.

Account passwords are stored only as hashes. Complete payment-card numbers are not stored by Turnip. They are handled by the payment gateway.

Where sharing enrolment information with a corporate, academic, government, or institutional partner is a stated deliverable of the program, that sharing is disclosed to the learner at registration, including which organisation may receive the data and for what purpose. The fields shared in that case are typically name, email, and institution.

A learner may ask for access to, correction of, or erasure of their personal data, withdraw consent where processing is based on consent, raise a grievance, and nominate another person to exercise these rights in the event of death or incapacity. People in the EU or EEA also have the GDPR rights of portability, objection, and restriction. California residents have the CCPA rights to know, to delete, and not to be discriminated against for exercising them.

Data hosting and location

Programs are hosted on Google Cloud Platform. Where a client prefers Amazon Web Services or Microsoft Azure, the program can be deployed on that platform alongside Google Cloud. Turnip endeavours to store personal data in India to the maximum extent possible, on whichever of these platforms is used.

Some providers process or store limited data outside India where their infrastructure requires it, including in the United States, the European Union, or another region where that provider operates. Where a transfer occurs, Turnip applies appropriate safeguards. Data is transferred only to jurisdictions that have not been restricted by the Government of India under the DPDP Act, 2023.

Technology and service providers

Providers are used only where a program needs them. Each provider receives the minimum data required for its function, is engaged to use that data only for that function, and is not permitted to use it for its own marketing. Turnip does not control those services. Their own terms and privacy notices apply to the processing they perform.

Other Turnip products, including IPGRAM Learn, may have their own privacy notice. A review should name the property in scope. Say which one, and the data flow for that program will be set out in the response.

Data retention and deletion

Personal data is kept only for the purpose for which it was collected, or longer where the law requires it.

Learners may request access, correction, or erasure in line with applicable law. A request is answered within 30 days.

Security incidents

If a personal-data breach is likely to cause harm to the people affected, Turnip notifies the Data Protection Board of India and the affected individuals as required by the DPDP Act, 2023. The notice covers the nature of the incident, the data affected, and the remedial measures taken or proposed.

Where a corporate or institutional agreement names a customer notification contact and a shorter clock, that agreement is followed in addition to the statutory duty.

Organizational controls

Technology is one part of the control set. Employees and contractors who can reach user information sign confidentiality and non-disclosure terms before that access is granted. Handling learner data with care is a condition of the engagement. Team members are trained on Turnip’s data-handling rules and on their duties under applicable law. Access is reviewed, and it is revoked when it is no longer required.

For procurement teams

A corporate program often needs a security review, a legal review, a privacy review, and a vendor questionnaire before it can be deployed. Send the questionnaire, the data-processing terms, and any program-specific privacy requirements with the request.

The reply will cover the proposed program architecture, the data flows, the providers in scope, the security controls on this page, and the service levels that will be written into the agreement. If a question asks for a certification, a penetration-test letter, or a numeric uptime target, the answer will state what can be provided for that review rather than imply a document that has not been issued.

Questions that help a review move quickly:

• which IPGRAM property or program is in scope;
• who the learner population is, and whether a partner institution will receive enrolment data;
• whether the program takes payment;
• whether the program should run on Google Cloud, Amazon Web Services, Microsoft Azure, or more than one of these;
• whether you need a data-processing addendum, a security schedule, or both;
• the availability target, support hours, and severity model your policy requires.

Need security or procurement information?