Security at StudyPat

Your data stays yours

• Every school has its own portal address. Each page a signed-in person opens is checked against the school they belong to, so a login from one school cannot open another school's portal.
• People see only what their role allows: teachers see their own classes and subjects, parents see only their own children, students see only their own results.
• Administrators can create sub-administrators and tick exactly which tasks each one may do (for example fees but not results).
• Once results are published, scores and remarks are locked until an administrator unpublishes them, so results cannot be changed by accident.
• When students are promoted, earlier terms stay exactly as they were, so old report cards and transcripts remain correct.

Signing in and passwords

• Passwords must be at least 8 characters. They are stored only as one-way (bcrypt) hashes, so neither StudyPat staff nor anyone with a copy of the database can read them.
• Repeated wrong sign-in attempts are slowed down automatically, on every sign-in page.
• "Forgot password" emails a one-time link that works for 60 minutes. Only the newest link works, it can be used once, and the link itself is stored only as a hash.
• Resetting a password signs that person out on every device, and ends any "remember me" session.
• Sessions end after 2 hours of inactivity. Session cookies are marked Secure and HttpOnly, and a new session is started at every sign-in.
• When a school deactivates a staff member, that person cannot sign in.
• Sign in with Google. People can use "Continue with Google" instead of a password. It only signs in someone who already has an account at that school with the same email address as their Google account: it never creates accounts, a person's Google two-step verification applies, and a deactivated account is refused exactly as with a password. Each school can switch it off in its preferences. StudyPat asks Google for the email address only.
• StudyPat staff can open a school's account for support only from our own control centre, and every such access is recorded against that school.

How we protect the application

• Every form is protected against cross-site request forgery, and everything a user types is escaped before it is shown on a page.
• The database is accessed only through parameterised queries, which is the standard defence against SQL injection.
• Uploads are limited to images, PDFs and office documents, with size limits. A school's public website accepts text, pictures and colours only; schools cannot add scripts.
• Pages that sit behind a sign-in cannot be framed by other websites, and browsers are told not to guess file types, to limit what is shared in the referrer, and not to use the camera, microphone or location.
• Payment confirmations (webhooks) are accepted only with a valid signature, and each payment is confirmed directly with the payment provider before anything is activated.

Payments

Card payments are made on the payment provider's own secure page (Flutterwave). Card numbers are never entered on StudyPat and never reach or are stored on our servers. We keep only the result of a payment (amount, reference and status) so that invoices and fee records are correct.

Monitoring and audit trail

• We record sign-ins, sign-outs, failed sign-ins and staff access to a school's account, with the time, internet address and type of device.
• Activity records are kept for 12 months. Records of ordinary page visits are kept for 60 days.
• Fee and payment totals are checked every night. If they ever stop balancing, our team is emailed and the school's Setup Check page shows it.

Hosting and infrastructure

• StudyPat runs on a dedicated server in a data centre in the United States, provided by IONOS. Your school's data may therefore be processed outside Nigeria, as set out in our Privacy Policy.
• The server's firewall allows only web traffic (HTTP and HTTPS) and administrator access. The database accepts connections from the server itself only and cannot be reached from the internet.
• Administrator access to the server is by cryptographic key only. Password logins are switched off, and repeated failed attempts are blocked automatically.
• The certificate covers every school's address, and any plain HTTP request is redirected to HTTPS.

Backups and recovery

• The database is backed up every night, and uploaded files every week. Backups are encrypted with AES-256.
• Nightly database backups are kept for 14 days and weekly file backups for 28 days.
• Past terms, results and fee records are never overwritten when a school moves to a new term.

The AI assistant and your data

The AI assistant is used for suggested report-card comments, lesson notes and quiz questions, and every suggestion is reviewed by a teacher before anything is kept. For comments, only the details needed for the task are sent: a student's first name, gender and scores. Surnames, email addresses, phone numbers, photographs and payment details are not sent.

Who handles data on our behalf

We do not sell school data and we do not use it for advertising.

Questions an IT team usually asks

Found a security problem?

If you believe you have found a weakness in StudyPat, please tell us before sharing it publicly. Write to support@studypat.com with the subject "Security report", say what you found and how to reproduce it, and do not access other people's data while testing. We aim to acknowledge every report within 2 working days and we will tell you when it is fixed. Our contact details for security researchers are also published at /.well-known/security.txt.