Security
Exams and student data are sensitive. This page summarizes how YouGrade protects them — honest measures, not marketing.
Infrastructure & encryption
All traffic is encrypted in transit with TLS (HTTPS enforced). Data is stored on managed hosting with restricted access; database files are outside the web root.
Isolation & access control
Every tenant record carries a school ID and every query is scoped to it — one school can never read another's data. Staff roles (admin, operator, teacher) limit what each member can do; plan-scoped shares restrict access to a single exam plan.
Application security
Passwordless staff login by one-time email code; CSRF tokens on every form; rate-limited verification and login endpoints; prepared SQL statements; teacher-authored content sanitized; student answers escaped on render; uploads stored outside public paths.
Student data minimization
Students never create accounts or passwords. Verification needs only a Student ID plus the last digits of a registered mobile — we match on the last 7 digits, so families can type numbers in any format.
Subprocessors
Two service providers may process data to run the platform: our cloud hosting provider (stores the application and database) and our email delivery service (sends sign-in codes and notifications to staff). No analytics or advertising providers receive personal data.
Incidents & disclosure
Found a vulnerability? Email hello@yougrade.net — please include steps to reproduce and give us reasonable time to fix before public disclosure. If a breach affects school data we will notify the affected school per the Data Processing Agreement.