Trust and Security

• HTTPS everywhere. Requests over plain http are redirected to https, and strict transport security is enforced.
• EU hosting. Application data lives in the European Union, in the eu-central-1 region (Frankfurt, Germany).
• Encryption in transit and at rest. Traffic uses TLS, stored data and backups are encrypted on disk.
• Passwords are hashed with the platform default and are never stored in readable form. Nobody, including us, can read your password.
• Two factor authentication is required for administrator accounts.
• Role based access. Every database table has row level security, and each account reaches only the records its role allows. An individual reaches only their own assessment result.
• Backups run automatically and are restorable, in the same EU region.
• The assessment scoring key and scoring logic are held server side. They are not present in the website code and are not returned in any network response.
• Rate limits protect the sign-in and assessment submission endpoints against automated abuse.
• Administrator access to the control centre is logged.
• Deletion on request. You can delete your account and results yourself, and any request sent to us is completed within 30 days.

A data processing agreement is available on request for corporate clients.

Security questions, or a report of a possible vulnerability, go to office@schoolforbutlers.com. We confirm receipt and keep you informed while we investigate.