Security
How student data is actually protected.
Plainly, not just in a compliance checkbox.
Where data lives
Course progress is stored locally on the student's own device by default. If a student sets a personal PIN to continue on a different device, their progress and reflections sync to our database, hosted in the UK.
Reflections are encrypted before they ever leave the device
Written reflection answers are encrypted in the student's browser — using a key derived from their own PIN via PBKDF2, then AES-256-GCM — before anything is sent anywhere. Nobody with access to the database, including us, can read a reflection's content without that student's PIN.
PINs aren't stored
A student's PIN is never saved anywhere. Only a one-way hash of it is stored, purely to check a returning student is who they say they are. The PIN itself only ever exists, briefly, in the student's own browser.
Access control
Database access is restricted with row-level security. Teachers only ever see results for their own school's codes — never another school's data.
No advertising, no tracking sold on
We don't sell, rent, or share student data with advertisers. This site itself doesn't run advertising trackers.
Found a security issue?
Please tell us directly at security@abity.co.uk before disclosing it anywhere else, so we can fix it first. We won't take action against anyone reporting a genuine issue in good faith.