Security and data
What we do with your organisation's data and your students' data. Only what is true today: if something is missing, ask us.
- Hosting
- The site and its database run on Cloudflare (Cloudflare Pages and D1). The database is created in Cloudflare's Western Europe region. Pages are served over HTTPS only.
- Separate organisations
- Each organisation's directors and coaches only ever reach their own students: every request is checked on the server against their organisation, and coaches only see the students assigned to them unless the director decides otherwise. Automated tests try to read another organisation's data and must fail.
- A separate service
- This platform has its own database, separate from any other product we run. No data is shared between them.
- Passwords
- The passwords of directors, coaches and students are stored as salted PBKDF2-SHA256 hashes, never in readable form. Too many wrong attempts lock an account for 15 minutes. Temporary passwords are shown once, to the person who created them.
- Sessions
- Director and coach sessions are stored only as hashes and end after 14 days without use. A new password ends every other session.
- In the browser
- A strict content security policy blocks scripts from other sites. Test files and question images are only served to signed-in students with an active seat.
- Backups
- Cloudflare D1 keeps a point-in-time history of the database for 7 days, so it can be restored after an incident.
- Tracking
- No advertising or tracking cookies. The cookies the site sets are only there to keep you signed in.
- Your data, your control
- Directors export their cohort and each student's report at any time. Removing a student deletes their account and all their results at once. When you leave, we delete your organisation and everything in it on request.
- GDPR
- For your students' data, your organisation decides and we process it on your behalf. On request, we sign a data processing agreement with you. Our only sub-processor is Cloudflare (hosting and database).
A question about security?
Write to us through the form: we answer every question in writing.