Security at Acatudy

Encryption

• All traffic is served over HTTPS, and browsers are told to use HTTPS only (HTTP Strict Transport Security).
• Sessions are encrypted and stored server-side; session cookies are HTTP-only and not available to scripts.
• Sensitive settings, such as each academy's Google sign-in credentials and secrets used by importers, are encrypted in the database.
• Card payments are handled by Stripe. Acatudy never sees or stores full card numbers.

Isolation between academies

Every record in Acatudy belongs to one academy, and every database query is filtered by that academy automatically. When something is created, it is always assigned to the academy of the person creating it, whatever the request says. Files are stored under each academy's own folder and the platform refuses to read or write outside it.

Automated tests try to read and change data across academies on every release, including account takeover and command-line scenarios.

Access control

• Each person has a role in each academy: owner, administrator, staff, teacher or student.
• Teachers can only open the subjects assigned to them, and only the parts of the dashboard their role allows. Removing a teacher's access takes effect on their next click.
• Students only see the content of the subjects and courses they are enrolled in.
• When Acatudy support needs to see an academy as its administrator to help, that session expires after 30 minutes and cannot delete data or change billing.

Sign-in and accounts

• Repeated failed sign-ins are limited per account and per network address, and the account is temporarily locked after several failures.
• Students set their own password from a personal link; academies never send passwords by email. Temporary initial passwords expire after 7 days.
• Passwords chosen at student sign-up and in the password change form are checked against known data breaches.
• Academies can let students and staff sign in with Google.

Files and uploads

• Videos and audio are delivered through temporary signed links that expire; other files are served through routes that check who is asking.
• Every upload is checked by its real content, not only its file name. Executables, installers and macro-enabled Office documents are rejected, including inside zip files.
• SVG images are inspected and rejected if they contain active content.
• Academy files are stored in object storage in the United States or the European Union, depending on the academy.

Platform protections

• Rate limits protect sign-in, registration, exam submissions, downloads, payments and the API.
• Security headers prevent other sites from framing the dashboard, stop browsers from guessing file types and limit access to the camera, microphone and location. A baseline Content Security Policy is enforced and a stricter one is being rolled out.
• Sensitive actions, such as billing changes, custom domains, imports and exports, teacher role changes, payments and support access, are recorded in an audit log with time, user and network address.
• We keep regular database backups, including one before every deployment.

Data ownership and deletion

• Your academy owns its content and its student data. You can export your question bank, gradebooks and payment records.
• Students can download their personal data and delete their account from the academy themselves.
• When an academy is closed and deletion is requested, its data, files, exclusive user accounts and domains are removed.
• Cookie consent records are purged automatically when they are no longer needed.

More details are in our privacy policy.

Questions and vulnerability reports

If your school or district has a security questionnaire, or you believe you have found a vulnerability, write to [email protected]. Please include the steps to reproduce the issue and do not access other people's data while testing.