Security

1. Every school kept separate

Each school's data is isolated from every other school's. The school is identified from the signed-in account on the server for every request, never from anything the browser chooses to send, so one school cannot reach another's classes, students or results.

2. Code runs in a sealed sandbox

Every piece of student code runs in its own isolated container with networking switched off and strict limits on processor time, memory and running time. A program cannot reach the internet, another student's work or the platform itself. When it finishes, the container is removed.

3. Accounts and access

• Passwords are stored only as strong one-way hashes and are never visible to anyone, including us.
• Changing a password ends the account's other signed-in sessions.
• Password reset never reveals whether an account exists.
• Access is role-based: principals, teachers and students each see only what their role allows.
• Sign-in and sensitive actions are rate-limited to slow down automated attacks.

4. Encryption in transit

All traffic between your browser and Quala Labs is encrypted with TLS.

5. Examination integrity

• Examinations can be bound to the school's own devices and network.
• Questions can be shuffled and varied per student, so that no two students see the same paper.
• Integrity events are recorded during the examination only, and are visible to the teacher with the context needed to judge them fairly.

6. A record that cannot be quietly changed

Platform administrative actions are written to an append-only, hash-chained audit log, so any later alteration would be detectable. Every agreement a school accepts is stored by version with the signatory's name and the time.

7. Collecting less

• Supervised assignment recordings are low resolution, carry no audio, and are deleted once marking is finished.
• AI features send only the question, the relevant code and test results to the model, never names or contact details, and are available only on plans that include them.
• Examination conduct data is deleted automatically after the period the school chooses.

8. Responsible disclosure

If you believe you have found a security vulnerability, please email support@qualalabs.com with the details. Please do not access or change data that is not yours, and give us reasonable time to fix the issue before disclosing it. We will acknowledge your report promptly and keep you informed.