Security and data protection

Security controls in place today

Every control listed here is implemented and active in the production system.

Encryption in transit

All connections are encrypted using TLS 1.2 or TLS 1.3. Weak protocols and ciphers are explicitly disabled. HTTP traffic is redirected to HTTPS automatically, and HSTS headers prevent downgrade attacks.

Encryption at rest

The database is stored on LUKS2-encrypted volumes using AES-256. Uploaded documents are stored in Cloudflare R2, which encrypts every file with AES-256. Database backups are encrypted with AES-256 before they are written.

Encrypted backups in two locations

A full backup every week, a differential backup every night, and continuous archiving of every change, so the database can be restored to any point in time. Backups are held in two separate places, a dedicated backup server in Germany and Cloudflare R2 in the EU, and are kept for up to 13 weeks.

Private database network

The database server accepts connections only from our own application servers, over a private network. A cloud firewall blocks all inbound internet traffic to it.

Argon2 password hashing

Passwords are hashed using Argon2, the winner of the Password Hashing Competition and the recommended algorithm for password storage. Plain-text passwords are never stored or logged.

Multi-factor authentication

TOTP-based two-factor authentication is available for all users and can be made mandatory for staff roles. All superuser and admin accounts are required by policy to have MFA enabled. Recovery codes are provided at enrolment.

Role-based access controls

A granular, three-tier RBAC system controls every action in the platform. Permissions can be granted or explicitly denied per-user. Roles can be time-limited, and a full audit trail records every change to who has what access.

School data isolation

Each school operates in a fully isolated tenant. Staff can only access data belonging to their own institution. This is enforced at the middleware layer on every request, not just in application logic. Cross-school access is impossible without superuser rights.

Private document storage

Sensitive student documents (identification, results) are stored in a private bucket with no public URL. Access is granted only via time-limited, cryptographically signed presigned URLs generated on demand. Documents cannot be guessed or enumerated.

Audit logging

Login events, permission changes, GDPR erasure requests, and payment waivers are written to immutable audit logs. Administrators can review who took what action and when across all security-sensitive operations.

CSRF protection and bot prevention

All state-changing requests require a CSRF token. Signup forms include Cloudflare Turnstile challenge and honeypot fields to prevent automated bot registrations. CSRF tokens are transmitted only over HTTPS-secured cookies.

PCI-compliant payment processing

Payments are processed by Stripe. No card numbers, CVV codes, or payment credentials ever touch our servers. Stripe webhook events are verified using cryptographic signatures before processing. We store only payment status and Stripe-issued references.

Hosted and delivered securely

The platform runs on infrastructure designed for reliability, resilience, and security.

Segregated object storage

Student files and platform assets are stored in separate public and private buckets. Private files require a valid time-limited signed URL to access. No direct public access is possible.

UK-hosted transactional email

Transactional emails are sent through Amazon Web Services in its London region, so email traffic stays in the UK.

In-memory session and cache layer

Sessions and cache are backed by a password-authenticated in-memory store. Sessions expire after 60 minutes of inactivity and are invalidated on password change.

Hardened reverse proxy with TLS termination

All traffic passes through a reverse proxy configured with TLS 1.2/1.3, strong cipher suites, HSTS, and security headers before reaching the application layer. IP-based direct access is blocked.

Real-time error monitoring

Application errors are captured in real time to enable rapid diagnosis and remediation. Personal data is not transmitted to monitoring infrastructure.

Secrets management

All credentials, including database passwords, API keys and payment keys, are stored as environment variables and never hardcoded in source code or version control.

Mandatory email verification

All accounts must verify their email address before accessing the platform. Unverified accounts cannot log in or submit data.

Session management

Sessions expire after 60 minutes of inactivity. Password changes immediately invalidate all active sessions. Secure, HttpOnly cookies prevent client-side access.

Resilient background processing

Background tasks run with strict time and resource limits to prevent runaway processes or resource exhaustion. Workers are automatically recycled to prevent memory leaks.

How we develop and maintain security

Security is a practice, not a feature. This is how we work.

Locked dependency management

All software dependencies are pinned in a lock file and installed from a frozen, verified state on every deployment. This prevents unintended updates and supply-chain substitution. Dependencies are reviewed before updates are applied.

Automated testing and CI

All code changes pass through an automated test suite backed by a full database before deployment. Payment processing, permission logic, and authentication flows are covered by tests. No untested code reaches production.

Static analysis on every commit

Automated static analysis and type-checking tools run on every commit before code is reviewed. These tools catch common security anti-patterns, including injection vectors and unsafe input handling, before code reaches the codebase.

Principle of least privilege

Access rights are granted at the minimum level required. Staff receive only the permissions their role requires. Permissions can expire automatically. Every grant and revocation is written to an immutable audit log with the actor, timestamp, and reason.

Injection prevention

All database queries use parameterised queries by default, making SQL injection structurally impossible in standard usage. Output is escaped by the template layer, protecting against cross-site scripting. Neither raw queries nor unescaped output are used.

Incident monitoring and alerting

Application errors are captured in real time. Critical errors trigger immediate alerts to the engineering team. Error rates are monitored continuously to detect unusual activity or degraded behaviour.

Compliance and standards alignment

We are transparent about what we have implemented, what we are working towards, and what we have not yet achieved.

UK GDPR and DPA 2018 Active

Educoda Ltd is registered with the Information Commissioner's Office (ICO registration ZB949031). We have published a privacy policy, support data erasure requests, and maintain a GDPR erasure log.

• ICO registration in place
• Published privacy policy
• Data encrypted in transit and at rest
• GDPR erasure requests supported
• Data (Use and Access) Act 2025 reflected in policy
• Planned: self-service data export for students

School Admissions Code Active

Data minimisation is built into admissions. In Admissions Code mode, which is on by default for new schools (existing schools switch it on from their settings), school staff only see the information that bears on their published admission arrangements until the student submits their enrolment on results day. The school remains the admission authority and is responsible for its arrangements.

• Demographics, SEN, FSM, medical, contacts, future plans, ID and references locked until enrolment
• Referee grades never used in admissions decisions
• Prohibited fields blocked from pot rules and results day gates
• SEN and FSM withheld from DfE education records until enrolment

Read more about the Code and the 2026 determination.

OWASP Top 10 Aligned with

The application is designed following OWASP Top 10 principles. Key risks are addressed through framework-level protections and deliberate architectural choices.

• A01 Broken Access Control: RBAC and tenant isolation
• A02 Cryptographic Failures: Argon2, TLS 1.3, presigned URLs
• A03 Injection: Django ORM (parameterised queries)
• A05 Security Misconfiguration: security headers, HSTS
• A07 Auth Failures: MFA, session expiry, email verification
• A09 Security Logging: audit trail active across key operations

Cyber Essentials In progress

We are working towards NCSC Cyber Essentials certification. The five key controls are partially in place across our infrastructure.

• Firewalls: cloud firewalls on every server, and the database reachable only over a private network
• Secure configuration: no debug mode, locked-down defaults
• User access control: RBAC, MFA, least privilege
• Patch management: automatic security updates on every server; formal patching policy in progress
• In progress: malware protection, formal policy in development

ISO 27001 Planned

We have not pursued ISO 27001 certification yet. Many of the technical controls required by the standard are already in place. Formal ISMS documentation, risk register, and third-party audit are on our roadmap.

• Access control (A.9): RBAC, MFA, audit logs
• Cryptography (A.10): Argon2, TLS, AES-256 at rest, signed URLs
• Backup (A.12.3): encrypted backups in two locations, with point-in-time recovery
• Incident management (A.16): Sentry monitoring
• Planned: risk assessment documentation
• In progress: vendor risk management

SOC 2 Not pursued

SOC 2 is a US-origin framework primarily relevant to American enterprise procurement. It is not currently on our roadmap. UK and EU customers are better served by our ICO registration and Cyber Essentials certification path.

• We do not hold or claim SOC 2 certification.
• Many underlying controls (availability, security) are implemented.
• Contact us if your procurement process requires this assessment.

Frequently asked questions

Answers describe how the system is built today, not what is planned.