Beautiful experiences.
Serious responsibility.
Security isn't a badge — it's a continuous discipline. Here is what this public website protects today, and what must be verified before sensitive school systems go live.
Secure by default.
These are concrete protections configured in the supplied website package. They do not constitute an independent audit or certification.
Never confuse a public website with a secured student platform.
Live production access requires more than attractive interfaces. Before collecting children's data or activating school accounts, we must verify:
- School-by-school tenant isolation and database Row Level Security
- Role-based access and protected authentication
- Verified sign-in, session controls and audit logging
- Data minimisation, retention and recovery procedures
- Encrypted transport, secure secret management and backups
- Independent penetration testing and privacy/legal review
These production controls are requirements to complete and independently verify; they are not represented as already active in the marketing website.
Every claim should be earned.
We do not claim ISO certification, international privacy certification or a completed security audit without evidence. Our development approach uses recognised principles such as OWASP ASVS for planning and testing.
Payment security design
Version 4 contains an opt-in backend for payment initialization, verification, byte-authenticated provider webhooks, transaction-reference verification, a private order ledger and signed refund/dispute flags that require manual review. Hosted checkout keeps sensitive payment credentials away from HLS. Production activation remains disabled until the gateway, database and anti-bot challenge are configured and tested; full operational security is not certified by a source-code package.
Explore payment options →