Security & Data Protection

A summary of the protections actually built into Elevix Assess. This page describes real, existing controls — not a compliance certification.

Account security

  • Passwords are hashed, never stored in plain text.
  • Email verification is required before a local account can access the platform.
  • Optional sign-in with Google, without ever storing your Google password.
  • An account can be suspended, immediately revoking access on its next request.

Access control

  • Teacher, student and platform-administrator roles are kept strictly separate.
  • Every sensitive action is checked server-side against an authorization policy — ownership is never assumed from a URL or form value.
  • A student can only ever see their own results, and only once a teacher has published them.
  • Class chat is limited to the teacher and enrolled students of that specific class.

Uploaded files

  • Every upload is checked against an allowed file type and content list before it is accepted.
  • Stored files are renamed to a random identifier — your original filename is never used as a path.
  • Uploaded files are stored where they cannot be executed as code.

AI credentials

  • A teacher-provided AI API key is encrypted at rest.
  • An API key is never displayed back to you in full once saved.
  • Elevix Assess never has, or asks for, access to a shared AI account — only your own.

Application-level protections

  • CSRF protection on every form submission.
  • Rate limiting on sensitive endpoints such as login and password reset.
  • CSV exports are protected against spreadsheet formula injection.

Data separation

  • A teacher can only ever manage their own classes, questions, assessments and students.
  • One teacher can never view another teacher's assessment results or student reports.

We do not claim any third-party security certification (such as SOC 2 or ISO 27001) or an independent penetration test at this time. This page will be updated if that changes.

Report a security concern

If you believe you've found a security or privacy issue, please contact us at [email protected], or via our Contact page.

Related: Privacy Policy · Terms of Service