Security & Data Protection

This document records the security, data-handling and accessibility controls implemented in the ScholarMeet platform, each verified against the application source code at the assessment date below.

Reference

SM-COMP-2026-08

Assessed

25 August 2026

Review Due

25 August 2027

Implemented Security Controls

Passwords are never stored in readable form
Session IDs are regenerated on every login
Session cookies are HttpOnly and SameSite=Lax
CSRF protection is enabled site-wide
Cookies are encrypted
Every database model uses an explicit field allow-list
Role-based access control on administrative routes
Uploads are validated and stored under system-generated names
Rich text is sanitised before it is stored
Database queries use parameter binding
Sign-in codes are single-use and short-lived
Password reset and change endpoints are rate limited
Google sign-in validates the OAuth state parameter

Data Handling

We never handle payment card data
Payment receipts are read in your browser
Credentials are hidden from every API response
Newsletter unsubscribe is one click, no login required
You can delete your account yourself
We do not sell your personal information

Scope and limitations. This is an internal, self-issued declaration — not a third-party certification, and not an audit against any external standard. It covers controls implemented in the ScholarMeet application code and verified by inspection of that code on the assessment date. It does not cover infrastructure, hosting, or network-layer protections, which are maintained separately, and it does not assert conformance with GDPR, DPDP, CCPA, WCAG or any other regulatory or accessibility framework. Controls not listed here should be taken as not claimed.