One login is the safer answer
The objection to centralized access is that it concentrates risk. In practice a dozen separate logins means a dozen password policies, a dozen offboarding processes and no single record of who saw what. Akonnect replaces that with one identity, one access model and one audit trail.
Four layers, each independently enforced
A failure in one layer does not open the others. Access decisions are made server-side on every request, not cached in the browser and trusted afterwards.
Identity
Single sign-on runs against your institutional directory over SAML 2.0 or OpenID Connect. Akonnect never stores your users' passwords, because it never sees them. Multi-factor authentication is enforced by your identity provider, using the policy you already set.
Authorisation
Role based access is evaluated per request against the role held at that moment. Revoke a role and the next action fails, including in a session that is already open. Scopes limit a delegated administrator to their own faculty or cost centre.
Data
TLS 1.3 in transit, AES-256 at rest, with per-tenant key separation. Backups are encrypted with the same separation and restore-tested quarterly. Institutional data is processed to run the platform and for nothing else — no model training, no resale.
Accountability
One audit trail spans every connected workspace. Sign-ins, role changes, record access and exports are written with actor, timestamp, workspace and source address, and cannot be edited from inside the product.
Twelve logins against one, on the questions auditors ask
The left column is what most institutions have today. It is not a strawman; it is the state we find on the first inventory.
| Question | Separate logins per platform | Akonnect centralized access |
|---|---|---|
| Joining and leaving | ||
| How long to provision a new research fellow? | Days, once every platform owner has responded | Under an hour, from the role assignment |
| What happens when someone leaves? | Each platform is revoked separately; some are missed | One revocation removes access everywhere, immediately |
| Can you list every system a person can reach? | Only by asking each platform owner | Yes, on one screen, with the role that grants it |
| Credentials and policy | ||
| How many password policies are in force? | As many as there are platforms | One — your identity provider’s |
| Is multi-factor authentication universal? | Only where each vendor supports it | Yes, enforced at the identity layer for every workspace |
| Where do credentials get reused? | Across platforms, unavoidably | Nowhere; there is one credential to reuse |
| Audit and evidence | ||
| Producing an access report for an audit | A data request per platform, reconciled by hand | One export, already reconciled |
| Who approved a permission change? | Often an email thread, if anything | Recorded in the audit trail with actor and timestamp |
| Detecting anomalous access | Per platform, if logs exist at all | Across all workspaces from one log stream |
Evidence you can produce without a data request
Every consequential action is logged once, in a format that reads the same whichever workspace it came from. Administrators query it directly; nobody has to ask us for an extract.
- What is recorded: authentication attempts, role and scope changes, record access in restricted workspaces, exports, and administrative configuration changes.
- Retention: 24 months online by default, longer where your regulator requires it. Retention is a tenant setting, not a support request.
- Integrity: append-only storage. Nobody, including Akonnect staff, can edit or delete an entry from inside the product.
- Export: CSV or JSON, filtered by workspace, actor, date range or action type.
by S. Kale · Publications · 09:12 IST
by A. Deshmukh · Research · 09:04 IST
by finance-admin · FMS · 08:47 IST
m.raghavan · blocked at identity layer · 08:31 IST
leaver process · automatic · 08:00 IST
Our position, stated plainly
We list what is in place and what is in progress. Where something is not yet certified, we say so rather than implying it.
Data residency
Primary and backup storage in India by default, with an EU region available on request. Residency is fixed per tenant at provisioning and does not change without your written instruction.
Digital Personal Data Protection Act, 2023
Akonnect operates as a data processor on your instruction. Consent records, purpose limitation and erasure requests are handled inside the platform, with a documented response path.
GDPR
A standard data processing agreement is available, covering sub-processors, transfer mechanisms and breach notification within 72 hours.
ISO/IEC 27001
In progress. Controls are implemented against the standard and audited internally; external certification is targeted for 2027. We will not describe this as certified until it is.
Penetration testing
Annual third-party test plus a test before any change to the identity or authorisation layer. Executive summaries are shared with institutional customers under NDA.
Sub-processors
A current list is maintained and published, with 30 days’ notice before any addition. Institutions may object to a new sub-processor.
Accessibility
WCAG 2.2 AA across all workspaces, verified by keyboard and screen-reader testing on each release.
Report a vulnerability
We accept reports from anyone, including students. Write to support@akonnect.in with “security” in the subject. We acknowledge within one working day and will not pursue good-faith researchers.
What institutions ask before signing
If one login opens everything, is that not a single point of failure?
It concentrates the credential and that is the point: one credential can be protected properly with multi-factor authentication, device checks and anomaly detection, where twelve cannot. Authorisation remains separate from authentication, so a compromised session still only reaches what that role permits, and every action it takes is logged.
Do you store our users' passwords?
No. Authentication is delegated to your identity provider, which returns an assertion. Akonnect never receives a password and has nothing to leak. Where an institution has no identity provider we can host one, and in that case password handling follows current OWASP guidance.
Can a department administrator see data from another department?
Not unless you grant it. Delegated administration is scoped: a faculty administrator manages people and records within that faculty and cannot enumerate anyone outside it. Scope boundaries are enforced server-side, and any attempt to cross one is logged as a denied access event.
What happens to our data if we stop using Akonnect?
You export it in open formats from each workspace, at any time, without asking us. On termination we retain the tenant for 30 days so you can complete extraction, then delete it including from backups within a further 60 days, and issue written confirmation.
How is double-blind peer review protected under a shared identity?
Identity and visibility are separate concerns. A reviewer authenticates as themselves, and the authorisation layer withholds author identity from the reviewer and reviewer identity from the author. Only the handling editor’s role can resolve both, and each resolution is written to the audit trail.
Do you use institutional data to train models?
No. Institutional data is processed to deliver the platform and for nothing else. This is a contractual commitment in the data processing agreement, not a policy we can revise unilaterally.
Send us your security questionnaire
We complete institutional questionnaires in full, including the questions where the answer is “not yet”. Most come back within five working days.