Security

Our approach

Classspace holds learning records for children, so protecting them is part of how the product is built, not an add-on. This page describes the safeguards that are in place today. We would rather describe a few real controls than list impressive-sounding ones we cannot stand behind.

Infrastructure and encryption

Classspace runs on Cloudflare's global platform. All traffic between your browser or app and our services is encrypted in transit with HTTPS. Data held in our databases and file storage is encrypted at rest by the platform.

Sign-in and accounts

We protect accounts in several ways:

• Passwords are never stored in readable form — they are salted and hashed with PBKDF2-SHA256.
• New password accounts are confirmed with a one-time code sent to the email address, and you can sign in with Google instead of a password.
• Session cookies are marked secure and HTTP-only, so scripts running on a page cannot read them.
• Sign-in, sign-up and verification endpoints are rate-limited to slow down guessing and automated abuse.

Who can see what

Access is role-based. Students see their own work; teachers see the classes and assignments they are responsible for; school administrators manage their own school; parents see only the children linked to them. A school's data is kept separate from every other school's.

Administrative tools used by the Classspace team are restricted to authorised staff accounts.

Payments

Card and bank details are collected and processed by Flutterwave, not by Classspace. We never see or store full card numbers.

School servers and desktop devices

Classspace school servers and desktop apps pair with a school through a setup key and an approval step, and each device is issued its own token that can be revoked. Software updates and lesson content packages are cryptographically signed, and devices only accept updates signed with Classspace's release key.

Children's data

We collect only what the learning product needs, we do not run advertising to children, and we do not sell personal information. See our Privacy Policy for the full detail.

If something goes wrong

If a security incident affects personal information, we will investigate it promptly, take steps to contain it, and notify affected schools and users, and any regulator, as the law requires.

Report a vulnerability

If you believe you have found a security problem in Classspace, please tell us through the contact page and choose "Security report". Include enough detail for us to reproduce it. Please give us reasonable time to fix the issue before sharing it publicly, and do not access, change or delete data that is not yours while testing. We will acknowledge good-faith reports and keep you informed.