Security

Passwords are hashed with bcrypt and never stored in a readable form — nobody at Supervizo can retrieve your password, only reset it. Sessions use signed tokens held in httpOnly cookies, which JavaScript cannot read, and tokens rotate on refresh.

Repeated failed logins lock an account for 15 minutes. Two-factor authentication (TOTP, compatible with Google Authenticator and similar apps) is available on every account, with single-use recovery codes for lost devices. An administrator can revoke every active session for a user at once.

Every submitted file is fingerprinted with a SHA-256 hash at upload. Submissions are immutable: a revised version is stored as a new record rather than overwriting the original, so the full history of what was submitted, and when, can always be reconstructed.

Uploads are scanned for malware before being stored when antivirus scanning is enabled for the deployment. Files carry per-request access checks — a submission, payment proof, or private message attachment cannot be reached by guessing or sharing a URL.

All traffic is served over HTTPS with HTTP Strict Transport Security, so browsers refuse to connect insecurely. The application sets a strict Content Security Policy and related headers to limit the impact of any injected content.

Invitation codes are stored hashed, in the same way passwords are — a copy of the database does not hand over usable credentials.

The database is backed up on an automated schedule, keeping seven daily and four weekly snapshots. Restores are documented and rehearsed rather than improvised.

Administrators can also trigger a backup on demand before a significant change.

Permissions follow defined roles — student, teacher, department administrator, institution administrator, and platform administrator — and every request is checked against them.

Institutions are isolated from one another: a user of one institution cannot read another's projects, users, or payments.

Administrative actions — approvals, role changes, payment verification, refunds, deletions — are written to an audit log with the actor, timestamp, and originating IP address.

The log is searchable and exportable by platform administrators, so any change can be traced back to who made it and when.