This page describes ConductClass controls. It does not claim that ConductClass has its own third-party certification.
Account security
- Accounts are invitation-only and require passwords of at least 12 characters.
- Password resets end existing sessions.
- Sessions expire, and important sign-in and access actions are recorded.
- Teacher, student, school-manager, and support permissions are checked on the server.
School separation
School, class, roster, assignment, work, and review records carry a school identifier. Server checks prevent a user from opening another school’s records.
Support access requires a separate support role and a named school. Support totals hide student and teacher work.
Data protection
Web traffic uses HTTPS. Our hosting and database providers encrypt customer data in transit and at rest. We keep secrets outside the code and do not store payment card details.
Logs are limited to service, request, timing, and error details. They must not contain passwords, tokens, class codes, student answers, names, or email addresses.
Recovery
We keep release rollback and database recovery steps. Before a production change, we check the build, database change, backup state, and rollback path.
Report a security issue
Email hello@conductscience.com with “Urgent: ConductClass security” in the subject. Include the time, page, and what you observed. Do not access or copy another user’s data.