Security

How we protect your data

School data is sensitive. We treat security as a core feature, not an add-on. Here is exactly what we do and how we do it.

Passwords — argon2id

All passwords are hashed with argon2id (memory-hard, GPU-resistant). We never store or transmit plaintext passwords. OAuth and SSO users have no password hash at all.

Encryption in transit — TLS 1.3

All data transmitted between your browser and Probita is encrypted with TLS 1.3. HTTP is redirected to HTTPS unconditionally. HSTS is enforced.

Encryption at rest — AES-256-GCM

Sensitive configuration secrets (SMTP credentials, SSO secrets, API keys) are encrypted with AES-256-GCM before being written to the database. Encryption keys are stored separately from the data they protect.

Tenant isolation — row-level security

Every database query executes inside a PostgreSQL row-level security context. Even a bug in application code cannot read another tenant's data — the database enforces isolation at query time.

Audit logging

Security-relevant events (logins, failures, permission changes, data exports, operator actions) are written to an append-only audit log. Operator access to customer data requires customer consent via a time-limited token.

Authentication

We support Microsoft Entra ID (Azure AD) and Google Workspace SSO in addition to password login. Operator (platform staff) accounts use a separate credential store with strict role-based access control.

Infrastructure

Probita runs entirely on Amazon Web Services (AWS) ap-south-1 in Mumbai, India. We use managed services (RDS PostgreSQL, S3, SES) that receive automatic security patches. No customer data leaves the AWS ap-south-1 region except for email delivery.

Our production instance runs behind an nginx reverse proxy with strict HTTP response headers including Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security. Server-identifying headers are suppressed.

Database credentials, API keys, and other secrets are stored in environment variables injected at boot, never in source code or configuration files committed to version control.

Security testing & compliance

Internal security audit

We conduct structured security code reviews covering OWASP Top 10, tenant isolation, authentication, and secret handling before each major release.

Annual penetration test (planned)

An independent penetration test by a third-party firm is planned annually. Our first external pen test is scheduled for Q3 2026.

PDPL-aligned architecture

Our data handling practices are designed to align with the UAE Personal Data Protection Law (PDPL). We maintain a Record of Processing Activities (RoPA) and support data subject rights requests.

ISO 27001-aligned practices

Our security controls are designed in alignment with ISO 27001 principles. Formal certification is on our roadmap as we scale.

Responsible disclosure

If you believe you have found a security vulnerability in Probita, please report it to us responsibly. Do not publish details publicly before we have had a chance to investigate and remediate.

Email: security@synctechnologies.ae

Please include: steps to reproduce, potential impact, and your contact details. We will acknowledge within 5 business days and keep you informed as we investigate. We do not currently offer a bug bounty programme.