Security Policy

1. Purpose and scope

This policy describes how the iLearn portal (ilearn.gov.in) protects the confidentiality, integrity and availability of the information and services it provides. It applies to the portal, its servers, its administrators, and everyone who contributes content to it.

2. Principles

• Collect and keep only the information that is needed to run the programme.
• Give each person only the access that their role requires.
• Protect information while it is sent and while it is stored.
• Find and fix weaknesses quickly, and record what was done.

3. Hosting and network security

• The portal is served only over HTTPS, with HTTP Strict Transport Security enabled.
• Standard security headers are sent with every page (content security policy, X-Frame-Options, X-Content-Type-Options).
• Configuration files, source code, environment files and hidden files are not served to the public.
• Servers are kept up to date with security patches, and unused services are disabled.

4. Application security

• Sign-in uses a managed identity service, and sessions are bound to the user and browser that created them.
• Pages that contain personal or learner information are available only after sign-in.
• Input from forms is validated, and forms that send e-mail are protected against automated abuse.
• Administrator access is limited to named officials and is reviewed regularly.

5. Data protection

Personal information is used only for the purpose for which it was given, as set out in the Privacy Policy. It is not sold or used for any other purpose, and it is shared only with the universities, Indian Missions and government agencies that need it to run the scholarship programme.

6. Security audit

The portal shall be audited by a CERT-In empanelled auditor before it is put into production and again after any major change. The audit report and the "safe to host" certificate are kept by the Ministry of External Affairs and the implementing agency, and any finding is fixed before the next release.

7. Vulnerability management

Software components are reviewed for known vulnerabilities and updated. Anyone who finds a security problem is requested to report it to support@ilearn.gov.in and not to publish it before it is fixed.

8. Logging and monitoring

Access and error logs are kept on the servers and reviewed when a problem is reported and during routine monitoring (see the Website Monitoring Plan). Logs are protected from change and are used only to run and secure the portal or as required by law.

9. Incidents

Security incidents are handled under the Contingency Management Plan, and are reported to CERT-In within the time limit set in its directions.

10. Roles and responsibilities

11. Review

This policy is reviewed at least once a year and after any major change or security incident.