Skip to main content
educati.
Apply now
Verifiable controls

Security · Data protection

What the platform protects — and how we can prove it

Every control described on this page maps to a mechanism actually implemented in the product. What is not done yet is written here too, on the same page, in the same detail.

Request a technical review

Two-factor auth

TOTP

RFC 6238 · recovery codes

Passwords

bcrypt

hashed · cost 12

HSTS

2 years

includeSubDomains · preload

Audit trail

Actor + IP

on every sensitive action

  • Two-factor authentication (TOTP)Self-serve per user, recovery codes included
  • Granular roles and audit trailEvery sensitive action is timestamped and attributed
  • Security headers across the whole domainCSP, HSTS, anti-clickjacking, MIME-sniffing blocked
  • Billing in dirhams (MAD)Tuition, schedules and receipts in the local currency
  • Interface in French, English and ArabicArabic rendered right-to-left, not a bolted-on translation
  • Per-institution data isolationOwn domain, theme and data for each institution
  • Pricing published publiclyStarting price and commitment terms visible before any contact

Implemented

The controls actually in place

Six mechanisms, all verifiable in the product: they apply to every hosted institution, with no option and no surcharge.

Security headers across the whole domain

CSP, HSTS (2 years, includeSubDomains, preload), X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, Referrer-Policy and Permissions-Policy (camera, microphone, geolocation disabled) apply to every route. The header that advertises the framework is removed.

Self-serve two-factor authentication

Each user turns 2FA on from their own account: a TOTP secret compatible with Google Authenticator, Authy or 1Password, single-use recovery codes, and disabling from the same screen.

Passwords and API keys are hashed

bcrypt with a cost of 12, for passwords and API keys alike. An API key is shown once, at creation: after that only its hash exists on the server.

Granular roles with expiring access

Permissions are recomputed from assigned roles, in institution or platform scope. An assignment that reaches its expiry date stops granting access immediately, with no manual step.

Timestamped audit trail

Every sensitive action is written with its author, the entity and its id, the IP address, the user agent and the timestamp. The trail is indexed by institution and by date.

Per-institution isolation

Every record carries its institution id and queries are filtered on it. Domain, theme and public content are institution-specific as well.

Transparency

What we do not claim

A security page is judged as much on what it refuses to display as on what it announces. Here is the real state of the open work.

  • No ISO 27001 or SOC 2 certification

    We display no certification logo, because we hold none. The controls above are verifiable in the product; they are not audited by a third party.

  • No published availability figure

    We publish no uptime percentage: there is neither an independent measurement instrument nor a contractual service-credit mechanism that would make it verifiable.

  • Application-level isolation, not Row-Level Security yet

    Isolation between institutions is enforced by the code. Moving to PostgreSQL RLS policies is planned and documented in our architecture blueprint; until it ships, we do not claim it.

  • Content Security Policy still being tightened

    The CSP is active across the domain but still allows the inline scripts and styles the framework needs. Moving to a nonce-based policy is tracked work, not an already-ticked box.

  • Rate limiting is per instance

    The counter that limits public forms and key-authenticated APIs lives in memory, so it is per application instance. A multi-replica deployment must add gateway-level limiting.

Morocco compliance

Legal identity · educati

Administrative and tax identifiers for the institution, verifiable with official authorities.

ICE

To be set

Common Enterprise ID

RC

To be set

Commercial Register

IF

To be set

Tax ID

CNSS

To be set

Social security

CNDP · Law 09-08

This institution's CNDP declaration status is not published on this site. The compliance tooling described below is available in the admin workspace regardless.Not stated

Tooling

Law 09-08 (CNDP) compliance tooling

Compliance is assessed by the CNDP, not by a badge on a website. What we provide is the tooling — available in the institution's admin workspace.

Eight-control checklist

The points to verify before an audit review or a CNDP enquiry, each with its status.

Processing register

Purposes, legal bases and retention periods, documented in the same place as the data.

Transfer mapping

The minimum mapping the CNDP requires for processing that leaves Moroccan territory.

72-hour notification

The breach-notification path towards the CNDP and towards the people concerned.

This tooling helps your institution meet its obligations. It is neither legal advice nor a declaration filed on your behalf.

Transparency

Hosting and subprocessors

E-mail, SMS and WhatsApp delivery, as well as payments, go through an abstraction layer: the provider actually used is a configuration choice, specific to each institution and each environment. So we would rather not display a generic list here that would not match your instance.

  • Providers configured per institution, not imposed by the platform
  • Exact list of active subprocessors sent in writing during the technical review
  • Hosting location confirmed by contract, not by a decorative map

Frequently asked security questions

Do you offer two-factor authentication?
Yes, via TOTP (RFC 6238). Each user enables it from their own account with the authenticator app of their choice, and receives single-use recovery codes so nobody ever gets locked out.
How are passwords stored?
Hashed with bcrypt at a cost of 12. No password is ever kept in clear text, and API keys get exactly the same treatment: the full key appears only once, at creation.
What exactly does the audit trail contain?
The action performed, the entity and its id, the author, the IP address, the user agent and the timestamp. It is indexed by institution and by date, so a precise timeline can be rebuilt during a review.
Are you ISO 27001 certified?
No — and we display no logo that might suggest otherwise. We describe the controls that are actually implemented, and the list of what is not done yet is published on this same page.
Where is the data hosted?
Hosting depends on your institution's contract and environment. We confirm it in writing during the technical review rather than displaying a location here that would not match your instance.
How do I report a security flaw?
Message us on WhatsApp or use the contact form with "security" as the subject. Describe the behaviour you observed and the URL involved, without attaching personal data belonging to a third party.
Security review

A security review, with the right people around the table

Leadership, IT or DPO: send us your questions or your assessment grid. We answer point by point, stating what is in place and what is not yet.

Request a technical reviewSee pricing

No document is promised blind: we answer your grid rather than sending a generic brochure.

  • Two-factor authentication (TOTP)Self-serve per user, recovery codes included
  • Granular roles and audit trailEvery sensitive action is timestamped and attributed
  • Security headers across the whole domainCSP, HSTS, anti-clickjacking, MIME-sniffing blocked
  • Billing in dirhams (MAD)Tuition, schedules and receipts in the local currency
  • Interface in French, English and ArabicArabic rendered right-to-left, not a bolted-on translation
  • Per-institution data isolationOwn domain, theme and data for each institution
  • Pricing published publiclyStarting price and commitment terms visible before any contact
Demo