Security

01 How we protect your account

• Passwordless sign-in, with one-time codes that expire in 10 minutes, or with Google.
• Sessions in secure cookies that the browser won't let other sites read.
• Protection against repeated sign-in attempts and against attacks on forms.

02 How we protect the data

• All traffic is encrypted with HTTPS.
• Every database query is limited to the creator making it, so no one sees another space's data.
• The keys to your payment accounts and the services you connect are stored encrypted.
• Private files are delivered through temporary links.
• Encrypted daily and monthly backups, stored outside the main server.

03 How we protect the infrastructure

• Servers with automatic protection against brute-force access attempts.
• Internal tools are only reachable by the team, with identity verification.
• Internal access limited to the people who need it, and a log of every administrative action.
• Error and availability monitoring around the clock.

04 If an incident happens

We have a procedure to contain, investigate and resolve incidents. If one affects your data, we tell you without delay and, for your students' data, within 48 hours at most, as set out in the Data Processing Agreement.

05 Reporting a vulnerability

If you find a security flaw, write to [email protected] with the subject «Security». Include the steps to reproduce it and its possible impact. We confirm receipt within 3 business days and let you know when it is fixed.

As long as you act in good faith and follow these rules, we will not take legal action against you:

• Test only with your own accounts or accounts created for the test. Don't access, change or delete other people's data.
• Don't run denial-of-service tests, social engineering or physical attacks.
• Don't publish the flaw until we have fixed it or 90 days have passed.

We don't have a cash reward program today, but we publicly thank every valid report if you wish.