Security

How we protect college data

Written for the person at your college who has to sign off on it. No "bank-grade" or "military-grade" claims — just what is implemented.

Last updated:

Accounts and passwords

Passwords are stored as one-way hashes using PHP's current default algorithm, never in readable form and never recoverable by us. Sign-in attempts are throttled per session.

Password resets

Reset tokens are random 32-byte values, stored only as a SHA-256 hash, valid for one hour and usable once. Completing a reset voids every other outstanding link for that account.

Tenant isolation

Every tenant-owned record carries a college identifier and every query filters on it. There is no administrative path in the customer application that reads across colleges.

Injection and forgery

All database access uses parameterised prepared statements. State-changing forms carry a per-session CSRF token that is verified server-side. Output is escaped on render.

Audit logging

Sign-ins, imports, exports, assessment creation, payment verification and privacy-relevant actions are recorded with the acting user, timestamp and source IP address.

Uploads and payments

Uploads are limited by type and size and validated before anything is written. Payment signatures are verified on our server; a browser claiming success changes nothing.

In transit and at rest

Where your data physically sits

The site is served over HTTPS. The application and database run on managed hosting infrastructure; encryption at rest and backup schedules are provided by that host under their terms, and we will name the provider and region in writing for any institution that asks.

Being straight with you

What we have not built yet

A security page that lists only strengths is not much use to the person evaluating it. As of today Tutorops does not have:

× Two-factor authentication or single sign-on
× Separate logins per staff member — a college account is shared today
× Expiring or proctored assessment links
× An independent security audit or a formal certification

All four are on the roadmap. If any of them is a condition of your procurement, tell us at and we will tell you honestly where it sits.

Reporting a problem

Found something?

Write to with enough detail to reproduce it. We will acknowledge, fix what needs fixing, and tell you what we did. We will not take action against anyone who reports a genuine issue in good faith.

Read the privacy notice →