Security Policy

Last updated: 24 August 2026

This page describes controls we have actually implemented. We do not claim certification against any standard unless it has been independently audited.

Access control

• Role-based access control with granular, named permissions.
• Tenant isolation — every query touching institution data is scoped to the institution that owns it, at the data-access layer rather than in the interface. One institution cannot reach another's students, applications, documents or reports.
• Students can access only their own records.
• Operators can access only the applications assigned to them.
• Two-step verification is required for administrator accounts and available to all users.

Data protection

• Passwords are hashed with bcrypt. They are never stored or logged in a recoverable form.
• Third-party portal credentials and bank account numbers are encrypted with AES-256-GCM using a key held outside the database.
• One-time passcodes are never stored.
• Documents are held in private storage outside the web root. Access is only ever through a signed link, tied to the requesting user, that expires within minutes.
• Sensitive fields are stripped from application logs, error reports and analytics.

Auditing

An append-only audit log records sign-in, document access, document decisions, status changes, operator assignment, credential access, consent, payments and configuration changes. There is no interface, at any permission level, for editing or deleting an audit entry.

Students are notified by email whenever their stored portal credentials are accessed.

Application security

Input is validated on the server for every request. Database access is fully parameterised. Cross-site request forgery is mitigated by same-site cookies and origin checks. Uploads are checked for declared type, real extension and size, with malware scanning integrated at the storage boundary. Rate limits apply to sign-in, one-time passcode issuance, uploads and write operations.

Operational security

Access to production systems is limited to named staff and reviewed regularly. Backups are encrypted. Dependencies are monitored for known vulnerabilities.

Reporting a vulnerability

If you believe you have found a security issue, please write to our support address with the detail needed to reproduce it. We will acknowledge within 3 working days and keep you informed. Please do not publicly disclose an issue before we have had a reasonable opportunity to fix it, and please do not access, alter or retain any data that is not yours while investigating.