Security practices.

Sign-in without passwords

There are no passwords, so there is no password database to breach. Sign-in sends one message, by email or text, that carries both a link and a six-digit code. Codes expire after ten minutes, allow five attempts and are single-use; links are 32-byte random tokens. Sessions last thirty days on a sliding basis, are revocable from Settings, and a sign-in from a new device sends an email notice.1

Transport and headers

Everything is served over TLS by Cloudflare. The application sets strict security headers, denies framing, and refuses cross-origin state-changing requests to the API. API responses are never cached.

Encryption at rest

Student email addresses, phone numbers and notes are encrypted at rest with AES-GCM under a key specific to your organisation, itself wrapped by a secret held outside the database. Cloudflare encrypts storage volumes beneath that. Imports can pseudonymise students on the way in.1

Tenancy and permissions

Every record belongs to one organisation and every query is scoped to it. Seeing student personal information is a distinct permission that markers, moderators and guests do not have; guests are time-boxed. Destructive actions require typing the word.

Audit

Every change that matters is written to an audit log with the actor, the target and a summary, and the log can be exported by the organisation. Application logs carry request identifiers and never personal information.1

Rate limits and abuse

Sign-in and the contact form are rate-limited by connection; the API is rate-limited per user. The contact form and sign-in use Cloudflare Turnstile. Inbound webhooks from Twilio and Stripe are verified by signature with constant-time comparison before anything is processed.

Secrets and dependencies

Secrets are held in Cloudflare's secret store and never in code or configuration files. Dependencies are pinned and few; the production bundle has no third-party scripts, fonts or images from other origins.

Artificial intelligence

Drafts are produced by models running on Cloudflare Workers AI. Student names and identifiers are replaced by pseudonyms before any prompt is sent, output is always labelled draft, and nothing is sent to a student without a person accepting it.2

Residency, stated honestly

Primary stores are placed in Cloudflare's Oceania region. Cloudflare does not offer an Australian jurisdictional restriction for D1 or KV, so we do not claim that every replica, backup or log stays in Australia.3

Targets, not yet facts

• An independent penetration test before the first University plan is signed.
• A published uptime measurement once there are twelve months of it.
• A security questionnaire in the sector's usual format, kept current.

Responsible disclosure

If you find a vulnerability, email security@coord.tools with enough detail to reproduce it. We will acknowledge within two working days, keep you informed, and credit you if you wish. Please do not access other people's data, and give us a reasonable time to fix the issue before publishing.