Security and data protection

Hosting inside the Kingdom

Platform data is hosted with a cloud provider inside the Kingdom of Saudi Arabia, in line with the Personal Data Protection Law.

Each institution's data kept apart

Each institution has its own platform, subdomain and accounts. Data is separated in the database itself by policies that stop any institution from reading another's data, and these policies are tested automatically with every update.

Encryption

Data between the browser and the platform travels encrypted over HTTPS. Passwords are stored with a strong hashing algorithm, never as readable text, and nobody can read them, the ClassWhy team included.

Sign-in and permissions

• Role-based permissions for administrators, teachers, students and parents, each seeing only their own share.
• Two-step verification, and sign-in with the institution's Microsoft accounts.
• A parent sees only their own children's data and never other students'.

Audit log

Sensitive actions, such as changes to grades or permissions and data exports, are recorded in an audit log the institution's administrators can review.

Built securely

• The platform is built and reviewed against the OWASP Top 10 web application risks, with automated tests that stop known flaws from returning.
• The website runs under a strict content security policy, with no third-party resources and no tracking tools.
• Work is under way to align the platform with the Essential Cybersecurity Controls of Saudi Arabia's National Cybersecurity Authority.

Backups and continuity

Data is backed up regularly and the backups are kept inside the Kingdom, so the service can be restored after a failure.

Reporting a vulnerability

The ClassWhy team welcomes security reports. Send them to info@classwhy.com with a description of the issue and the steps to reproduce it; the team confirms receipt and follows up on the fix. Please do not disclose the issue publicly before it is fixed, and do not access or change other people's data.