Security

All traffic to and from SuperExams is encrypted with HTTPS/TLS, and we enforce it with HSTS so browsers never connect over an insecure link. Data stored in our database and file storage is encrypted at rest by our infrastructure providers.

• Passwords are hashed with bcrypt (a slow, salted algorithm) — we never store or see them in plain text.
• Two-factor authentication (2FA) is mandatory for all staff and teacher accounts, because those accounts can view student data. Students can enable it too.
• We rate-limit and lock out repeated failed logins to stop brute-force and password-spraying attacks.
• Changing or resetting a password signs out other sessions, so a stolen password can be shut out immediately.
• Optional Google sign-in is supported, with safeguards against account take-over.

Every request is checked against the account’s role and ownership. A student can only ever see their own data; a teacher only their own classes; whole-school reporting is limited to a school’s own staff. We follow the principle of least privilege — accounts get the minimum access they need.

Security-sensitive actions — sign-ins, role changes, password and 2FA changes, and account deletions or staff offboarding — are written to an append-only audit log. This lets us investigate any concern and answer questions about who accessed what.

We build on established, security-focused providers rather than running our own servers:

• Vercel — application hosting and delivery
• Neon — managed PostgreSQL database (encrypted at rest, point-in-time backups)
• Cloudflare R2 — file storage for papers and materials (encrypted at rest)
• Stripe — payment processing (PCI-DSS Level 1)
• Anthropic — the AI model behind the tutor and marking features
• Google — optional sign-in and transactional email
• Sentry — error monitoring

Each acts as a processor under contract. Our full list and the data they handle is set out in our Data Processing Agreement.

• Strict security headers, including a Content-Security-Policy, HSTS, and clickjacking and MIME-sniffing protection.
• Payment webhooks are cryptographically signature-verified, so payment events can’t be forged.
• Secrets and API keys are never stored in our code; they live only in a secured environment and the app fails closed if a critical secret is missing.
• User-generated content is escaped to prevent cross-site scripting (XSS), and database queries are parameterised against injection.
• We run regular internal security reviews and keep dependencies under review.

All card payments are handled by Stripe. Card details are entered on Stripe’s systems and we never see or store full card numbers.

We collect as little personal data as we can and use it only to run the service. Accounts and their data can be exported or deleted on request. For the legal detail, see our Privacy Policy and Data Processing Agreement. Where data is processed outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We monitor the application for errors and unusual activity. If a personal-data breach affecting your school ever occurred, we would investigate promptly and notify affected schools and, where required, the relevant data-protection authority, in line with our legal obligations.

If you believe you’ve found a security issue, we want to hear from you. Please email support@superexams.com with the details and we’ll respond as quickly as we can. Please don’t publicly disclose an issue before we’ve had a chance to fix it, and don’t access or modify other users’ data while testing.