Security Overview

Security and privacy are considered throughout the design and development of ATL Portfolio. We apply the principle of privacy by design: collect the minimum data necessary, restrict access by role and school, and isolate each school's data at the database layer.

We recognise that we hold evidence of student learning and assessment information, and we treat that responsibility seriously. Where a particular capability is not yet independently verified, we say so rather than overstate it.

• Secure hosting — the Platform is hosted on Base44-managed infrastructure and its disclosed subprocessors.
• HTTPS everywhere — all traffic is served over TLS.
• Encryption in transit — data is encrypted between your device and our servers.
• Encryption at rest — stored data and file uploads are encrypted in cloud storage.
• Secure storage — file uploads are held in isolated, access-controlled cloud storage.

• Password security — sign-in is managed through the platform's hosted authentication; passwords are never stored in plaintext.
• Role-based permissions — students, teachers, coordinators, admins and superusers each have defined access.
• Session management — sessions use tokens with expiry; sign-out revokes the session.
• Secure login — school email domain verification before access to school data is granted.

The Platform is built on a modern framework with protections against common web vulnerabilities:

• Cross-site scripting (XSS) — output is escaped and rendered through a modern UI framework.
• SQL injection — data access uses an abstraction layer with parameterised queries; no raw string-built SQL.
• Cross-site request forgery (CSRF) — authenticated session handling reduces CSRF risk.
• Authentication attacks — session token expiry and domain-based access reduce account exposure.
• Input validation — form and API inputs are validated before processing.
• Secure HTTP headers — served over HTTPS with appropriate security headers.

• Access controls — platform staff access is restricted and granted on a need-to-know basis.
• Principle of least privilege — access is scoped to the minimum required for a task.
• Change management — platform changes are reviewed before release.
• Monitoring — platform availability and errors are monitored.
• Incident response — a documented internal incident-response process covers triage, containment, evidence preservation, School notification, provider escalation, remediation and post-incident review.

We welcome responsible disclosure of potential security vulnerabilities. If you believe you have found a vulnerability, please:

• Email security@atlportfolio.com with a description and, if possible, steps to reproduce.
• Avoid accessing or modifying data that does not belong to you.
• Allow us reasonable time to investigate and remediate before any public disclosure.

We acknowledge reports within two business days and keep you informed of remediation progress.

• Backup strategy — platform-level recovery is managed by the underlying hosted platform; independent LearnStudio export, backup and restore procedures are being separately verified.
• Disaster recovery principles — the hosted infrastructure provides redundancy and recovery for the database and file storage layers.
• Data resilience — school data is isolated and access-controlled, so an issue affecting one school does not expose another.