Security
Security is designed in, not bolted on.
Account security
Email OTP verification with expiry and throttling, hashed passwords and codes, login rate limiting, session regeneration and secure cookies. Optional two-factor authentication for administrators.
Data isolation
Every school's data is isolated at the database level. Automated tests prove that one school can never access another school's students, questions or papers.
Application protections
CSRF, XSS and SQL-injection protection, strict file validation (no SVG uploads), SSRF-guarded URL import, security headers, signed download URLs and scheduled cleanup of temporary files.
Accountability
Sensitive actions are recorded in audit logs. Database and file backups run on schedule with checksums and failure notifications.
Reporting a vulnerability
Please contact us with "Security" in the subject line. We appreciate responsible disclosure and will respond promptly.
Last updated: 2026-07-27