Security Posture: Enterprise Grade
Last reviewed: August 2026 · Review cycle: quarterly
CSP Headers
RLS Enabled
Audit Logging
COPPA Ready
Authentication & Access Control
- Email/password authentication with email verification (OTP)
- Google OAuth provider integration
- Password policy: minimum 8 characters with uppercase, lowercase, and number
- Password strength scoring with common-password detection
- Session timeout: automatic logout after 30 minutes of inactivity
- Brute force protection: account lockout after 5 failed attempts (15-minute window)
- Two-Factor Authentication (2FA) prompts for teachers and admins
- Parental PIN: SHA-256 hashed PIN for sensitive actions
- Row-Level Security (RLS) on every entity — users see only their own data
- Role-based access: admin, teacher, parent, and student roles
Data Protection & Privacy
- All data encrypted in transit (TLS/HTTPS)
- Row-Level Security isolates parent, teacher, and student data
- Parental PIN never stored in plaintext — SHA-256 hashed client-side
- Phone numbers verified via OTP before account activation
- Data Subject Access Requests (DSAR): export and delete via Parent Data Rights
- Data retention policy: audit logs kept 90 days, login attempts 30 days
- Automated nightly cleanup of expired data (SecurityDataRetention workflow)
- No third-party data sharing — all data stays within the Base44 platform
- Children's data: minimal collection, parent/guardian consent required
Child Safety (COPPA Compliant)
- Age verification required at registration (18+ confirmation)
- Children registered and managed by parent/guardian accounts
- Content moderation: automated profanity, PII, and aggression detection
- Flagged content review queue with admin oversight
- Discussion board posts require approval for children
- No direct messaging between children — teacher-mediated only
- Parental controls: PIN-protected sensitive actions
- Screen time reminders for kid-mode users
- No collection of biometric data
- No behavioral advertising to children
Security Headers & Network
- Content-Security-Policy (CSP): restricts scripts, styles, and connections
- X-Content-Type-Options: nosniff — prevents MIME type sniffing
- X-Frame-Options: SAMEORIGIN — prevents clickjacking
- Referrer-Policy: strict-origin-when-cross-origin
- Object-src: none — blocks Flash/plugins
- Base-URI: self — prevents base tag injection
- Form-Action: self — prevents form hijacking
- HTTPS enforced on all connections
Monitoring & Audit
- Comprehensive audit logging: all create/update/delete operations recorded
- Security event logging: auth events, password changes, role changes
- Login attempt tracking: IP, user agent, success/failure, timestamp
- Brute force detection: automated incident creation after 5+ failures
- Device login tracking: new device alerts to the user
- Admin security dashboard: real-time monitoring of flags, logs, incidents
- Security incident tracking: breach, unauthorized access, data leak records
- Auth event workflow: all signups and logins logged automatically
Incident Response
- Security incident tracking with severity levels (low, medium, high, critical)
- Automated brute force incident creation with severity escalation
- Incident lifecycle: open → investigating → resolved → closed
- Admin password reset capability for compromised accounts
- Teacher ID verification review queue
- Data breach notification: admins notified of all critical incidents
- Content takedown: flagged content removed pending review
- Account suspension: admins can disable accounts immediately
Compliance
- COPPA (Children's Online Privacy Protection Act) — child data protection
- GDPR (General Data Protection Regulation) — data subject rights
- PIPEDA (Personal Information Protection and Electronic Documents Act) — Canada
- FERPA-aligned — student educational record protection
- Privacy policy publicly available at /privacy
- Parent data rights page at /parent-data-rights
- Data export and deletion requests supported
- Cookie-free authentication — no tracking cookies
Report a Security Issue
If you discover a security vulnerability or suspect a data breach, report it immediately to the admin team. All reports are treated as confidential and investigated promptly.