Security and trust
How we protect your account and data.
What we do today, in plain words. We only list what is actually in place.
- Accounts
- Administrators must use two-step sign-in (an authenticator app) before they can open the admin area, and the database checks this again on every sensitive action. Learners and tutors can turn on two-step sign-in for their own accounts. Repeated wrong passwords cause a short sign-in pause.
- Payments
- Payments are not open yet. When they open, card payments will be taken by Paystack on Paystack's own secure pages, so your card details never reach our site and we never store them.
- Your data
- Course content, project files and personal records are private by default. Access is checked on our server for each request, not just in your browser, and people can only see their own records unless their role needs more.
- Uploads
- Uploaded files are checked on our server from the file itself, not just its name. Files that need a safety scan stay private until a scan clears them.
- Staff actions
- High-risk admin decisions need two different administrators, and important changes are recorded in an audit history.
- AI
- Leo, our AI assistant, gives advice only. It never makes final decisions about grades, certificates, payments or accounts.
Report a security problem
If you think you have found a security problem, please tell us through the Help & Support form (sign in first) and describe what you found. Security reports go straight to administrators. Please don't share other people's data while testing. We will never ask for your password or sign-in codes.
Read our Privacy Policy and Terms.