Security & Incident Response

Version 2.0 · Effective 29 October 2026 · Fikra Smart (fikrasmart.com)

Infrastructure

• Hosting: the website is served by Vercel; the database, authentication and file storage run on Supabase (Tokyo, Japan). Both providers publish independent security attestations (for example SOC 2) on their trust pages. Fikra Smart itself does not currently hold ISO 27001 or SOC 2 certification.
• Encryption: all traffic uses HTTPS/TLS with HSTS (2 years, includeSubDomains, preload); data is encrypted at rest by the providers.
• Browser hardening: X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers.
• Backups: provider-managed backups and recovery.

Access control and data separation

• Row-level security on database tables: a signed-in teacher can read and change only their own classes and content; students can read and write only what their class membership allows.
• Student identity: students get an anonymous per-device identity; class membership is checked server-side; marks are recorded only for PIN-verified joins; the join flow resists class-name enumeration.
• Secrets: AI provider keys and service-role keys exist only in server-side secrets, never in the browser or the repository. The public client key is designed to be public and is restricted by the access rules above.
• Admin functions are available only to authorised administrators and verified on the server.
• Least privilege: the owner's access to customer data is limited to support, security and legal needs (see Privacy Policy).

Application security

• Output escaping and sanitisation of user content to prevent cross-site scripting; dependency versions pinned.
• Daily AI usage caps and size limits to prevent abuse and cost attacks.
• Sign-in by emailed code or Google; no passwords for students.
• Uploaded interactive lessons are size-limited.

Your responsibilities

• Use trusted devices and keep software updated; sign out of shared computers.
• Do not share sign-in codes or PINs; change a class code if it leaks.
• Do not enter sensitive personal data into the Service.
• Remove access for staff who leave, and tell us quickly about suspected misuse.

Incident response

1. Detect and triage: from provider alerts, logs, user reports and the disclosure channel; severity is classed within 24 hours.
2. Contain: revoke or rotate keys, block abusive access, disable the affected feature.
3. Investigate: establish what data, which customers, how and when.
4. Notify: affected schools/users without undue delay and, for processor data, within 72 hours of awareness, so controllers can meet their own legal deadlines (for example GDPR Art. 33 and UAE PDPL); regulators where we are the controller and the law requires.
5. Recover and learn: restore service, fix root cause, document lessons, and share a summary with affected customers.

Report a vulnerability (responsible disclosure)

If you find a security issue, email support@fikrasmart.com with subject "Security". Include what you found, steps to reproduce, and the impact. See also security.txt.

• We acknowledge within 3 business days and keep you updated until fixed.
• Safe harbour: if you act in good faith, avoid privacy harm, service disruption and data destruction, access only what is needed to demonstrate the issue, do not exfiltrate or keep other people's data, and give us reasonable time to fix before disclosing, we will not pursue legal action against you for your research.
• Out of scope: social engineering of staff or users, physical attacks, denial of service, spam, and reports from automated scanners without a demonstrated impact.
• We do not currently run a paid bounty, but we are glad to credit researchers with their permission.

Business continuity

Our providers offer redundancy and restore capabilities; the service's source code is kept under version control in a private repository so it can be rebuilt and redeployed.