Security & Trust
Student data can stay on your server.
A self-hosted application with no cloud dependency, designed for FERPA-aligned deployment and institutional control.
Security and privacy controls
Concrete controls, clearly stated.
Authentication
Passwords use bcrypt. Session tokens are stored only as SHA-256 hashes and invalidated after password changes.
Authorization
Admin and Teacher/TA roles are enforced with row-level data scoping, not only hidden interface controls.
Application security
Parameterized queries, output escaping, CSP, HSTS, frame denial, server-side QR validation, and rate limits protect core paths.
Data control
Location and device collection can each be disabled institution-wide. Retention rules can erase those details while preserving the attendance fact.
Audit and exports
Administrative changes are attributable. CSV exports are sanitized against spreadsheet formula injection.
Operations
Structured logs, a health endpoint, daily automatic backups, and configurable retention support institutional operations.
Network disclosure
No hidden analytics or tracking services.
External requests are limited to one-time classroom address geocoding, server-proxied map tiles, and a locally bundled device-correlation library with a CDN fallback. Student data is not sent through those services.
No external fonts, advertising trackers, or website analytics are required by the deployed product.
Assurance status
Honest about what is not claimed.
Independent testing
Third-party penetration testing is not yet complete.
Accessibility
A formal VPAT and third-party audit are not yet available.
Integrations
SSO and automatic LMS or SIS synchronization are not currently implemented.
Certifications
FERPA certification, SOC 2, and ISO certification are not claimed.
Data responsibility
Clear roles for education records.
Production agreements define access, deletion, hosting, support, and institutional requirements. Location analytics should be deployed only with documented policy, faculty notice, and appropriate institutional review.
Bring your technical requirements.
Review controls, deployment, assurance, and the production path with our team.