Security and responsible disclosure

Our approach

Institute Console ("Institute Console") holds information about students, families and staff, so security is part of how we build and run it. This page summarises our main safeguards and tells security researchers how to report a vulnerability. Institute Console is operated by DEXDEVS (SMC-PRIVATE) LIMITED.

How we protect Institute Console

Encryption in transit. All traffic uses HTTPS with TLS 1.2 or higher and HTTP Strict Transport Security.
Encryption of backups and secrets. Backups are encrypted, and sensitive values such as integration credentials are encrypted in the application.
Separation between Institutes. Each Institute's data is isolated at the database level with row-level security.
Least-privilege access. Permissions are granted by capability and branch, not by job title alone, and sensitive identifiers are masked for people who do not need them.
Strong sign-in. Passwords are hashed with Argon2id, two-factor authentication is available, and accounts lock after repeated failed sign-ins.
Tamper-evident audit log. Changes to records are logged with who made them and when, in an append-only, cryptographically chained log that is checked automatically.
Controlled change. Production changes are made only through a reviewed, recorded deployment process, and every deployment can be traced to a specific code version.
Mobile app. Sign-in tokens are kept in the device's secure storage, biometric unlock is handled by the device and never leaves it, and crash reports are anonymous.

We review and improve these measures over time. No system is perfectly secure, and we do not claim that Institute Console is free of vulnerabilities, which is why we welcome reports.

Reporting a vulnerability

If you believe you have found a security vulnerability in Institute Console, please email security@instituteconsole.com. Include:

a description of the issue and where it occurs (URL, app version, or API endpoint);
the steps needed to reproduce it; and
the impact you believe it has.

Please do not include real personal data in your report. If you came across any personal data while testing, tell us what you saw, and do not keep or share it.

We will acknowledge your report, keep you informed as we investigate, and let you know when the issue is resolved. We do not currently run a paid bug bounty programme.

Testing guidelines

When researching Institute Console, please:

use only accounts you own or have permission to use, and never access, change or delete another person's data;
stop as soon as you have confirmed a vulnerability, and do not use it to go further into the system;
avoid anything that degrades the service for others, such as denial-of-service, load or spam testing;
do not use social engineering, phishing or physical attacks against our staff, Institutes or users; and
give us reasonable time to fix the issue before telling anyone else about it.

Safe harbour

If you make a good-faith effort to follow these guidelines, DEXDEVS will treat your research as authorised, will not pursue legal action against you for it, and will not ask law enforcement to act against you for it. If a third party brings a claim, we will make it known that your research was carried out in line with this statement. This commitment applies only to DEXDEVS and to Institute Console; it cannot authorise testing of systems owned by others, such as our service providers or an Institute's own systems.

Account security help