An ERP ends up holding more sensitive material than anything else your institute runs: every student’s personal details, parents’ contact numbers, fee and concession history, marks, attendance, staff salaries. Most purchase conversations never touch this until the contract is drafted, and by then the leverage has gone.
Five things are worth settling in writing before you sign, and none of them require you to be technical.
1. Ownership — say it explicitly
The contract should state that the institution owns its data. Not “has access to”, not “may request an export”. Owns. This sounds obvious and is frequently absent, and the absence only becomes visible at the one moment you cannot afford it — when you want to leave.
DigiERP’s position is that your data is yours, exportable at any time, with a full handover if you ever move on.
2. Exit — get the clause before you need it
Ask three questions and write the answers into the agreement: on what notice can we leave, in what format do we get our data, and what does the handover cost? A vague answer here is itself the answer. The honest version is a defined notice period and a free handover; DigiERP is one month’s written notice with no exit charge.
The test is simple. If leaving is expensive or undefined, you are not buying software, you are buying a dependency.
3. Hosting and backups — ask for specifics
Where does the data physically sit, who has administrative access to the server, how often is it backed up, and — the question most people forget — when was a restore last actually tested? A backup nobody has restored from is a hope, not a backup. Ask for the date of the last restore test. The answer is revealing.
4. Access control inside your own institute
Most real data incidents at institutes are not external attacks. They are internal: a shared admin password, a departing staff member whose login still works, a clerk who can see staff salaries because everyone has the same role. Insist on role-based access, individual logins rather than shared ones, and an audit trail showing who changed what. Then run your own check twice a year — list the active logins and remove the people who have left.
This is another place where per-user pricing does active harm: when logins cost money, institutes share them, and a shared login means no audit trail and no accountability. Unlimited users is a security feature as much as a commercial one.
5. What the vendor may do with your data
Ask plainly whether your data is used for anything other than running your institute’s system — analytics across customers, product development, marketing. You are entitled to a clear no in writing, and to know whether any sub-processors are involved.
A short clause checklist
- The institution owns its data, stated in those words.
- Export in a usable format, on demand, at no charge.
- Defined exit notice and a free handover.
- Named hosting arrangement, backup frequency, and the date of the last tested restore.
- Role-based access with individual logins and an audit trail.
- No secondary use of institutional data; sub-processors disclosed.
- A named contact for incidents, and a commitment to inform you if one occurs.
Take that list to every vendor on your shortlist, ours included. Any of them should be able to answer all seven in a single meeting, and the ones that cannot have told you something important.
Talk to us
DigiERP is built for schools, colleges and universities: all modules included, unlimited students, staff and parent accounts, one flat annual AMC, live in 1–2 weeks, implemented by the team that builds it, and exit on one month’s notice with a free data handover. Call +91 83498 62321 or write to contact@digierp.in and we will run your own data through the system, no obligation.
More on choosing campus ERP: Top 5 ERP software in India · Top 25 · the state-by-state guide.
