This standard summarises the safeguards we use to protect your information. It supports our Privacy Policy.
1. Encryption and transport
- 1.1All pages and the classroom are served over HTTPS. Plain http requests are redirected to https.
2. Sign-in and credentials
- 2.1Passwords are stored only in hashed form. Email sign-in links and QR sign-in tokens are single-purpose, expire quickly, are stored only as hashes and are invalidated after use. Never share them (see Acceptable Use).
- 2.2Repeated failed logins trigger automatic blocking (fail2ban and rate limits).
3. Access control
- 3.1We apply least privilege: staff and contractors get only the access their role needs. Administrator accounts are separate, protected by strong passwords, and reviewed regularly. Secret keys are kept out of website code and public files.
4. Servers and software
- 4.1Our systems are hosted in a professional data centre. We patch operating systems and applications, run a security gate that scans every website release for exposed secrets and insecure links, and check the live site after each release.
5. Backups and recovery
- 5.1Classroom data is backed up regularly and backups are held separately from the live system. We test restoration from time to time.
6. Monitoring and incidents
- 6.1We monitor availability and security logs. Incidents are handled under our Data Breach Response procedure.
7. Report a vulnerability
- 7.1If you find a security weakness, email coreknowledgedigital@gmail.com with the subject "Security vulnerability". Please give details so we can reproduce it, do not access other people's data, and allow us reasonable time to fix it before you disclose it. We will acknowledge within two (2) working days.