Our approach
Security is designed into the platform rather than added at the end. We apply least-privilege access, defence in depth and secure defaults, and we treat every feature that touches personal data as a security-relevant change.
We do not list certifications or audit reports on this page unless they have been formally completed. If your procurement process requires specific attestations, contact us and we will share what is available and what is in progress, in writing.
Planned controls by layer
Encryption
Traffic is encrypted in transit with TLS. Sensitive data is protected at rest using platform encryption.
Identity & access
Role-based permissions by department, campus and function, with optional single sign-on through your identity provider.
Sessions
Secure, HTTP-only cookies, session rotation on sign-in, idle timeouts and CSRF protection on every form.
Audit trails
Sign-ins, permission changes and sensitive actions are logged for review.
Application security
Parameterised database queries, output escaping, input validation and rate limiting against automated abuse.
Operations
Monitored infrastructure, backups and documented incident response procedures.
How we will handle a security incident
Detect and contain
Monitoring and reports are triaged; affected components are isolated.
Assess
We determine what data, institutions and people are affected.
Notify
Affected institutions will be informed without undue delay, and we will support any regulatory notifications they must make.
Remediate and learn
Root causes are fixed and preventive measures documented.
Report a vulnerability
If you believe you have found a security vulnerability in Acadlytic, please email info@acadlytic.com with the subject “Security report” and include enough detail for us to reproduce the issue. Please do not access data that is not yours, disrupt the service or publicly disclose the issue before we have had a reasonable opportunity to fix it. We will acknowledge valid reports and keep you informed of progress.
Frequently asked questions
How does Acadlytic protect student data?
Through encryption in transit, role-based access, audit trails, secure development practices, monitoring and documented incident response. Security documentation is shared with institutions during evaluation.
Does Acadlytic hold security certifications?
We list attestations only once they are formally completed. Contact us for the current status and the documentation available for your procurement review.
How do I report a security vulnerability?
Email info@acadlytic.com with the subject “Security report”, including the steps to reproduce the issue. Please do not access other people’s data or disclose the issue publicly before it is fixed.