Security

All traffic to and from Excellent is encrypted in transit with TLS 1.2+. The CDN refuses unencrypted connections.

Stored data — including exam scans, answers, and reports — is encrypted at rest using disk-level encryption provided by our database and object-storage provider.

Every record in the database is tagged with a workspace and protected by row-level security policies. Even at the database level, a member of Workspace A cannot read or write rows that belong to Workspace B.

Privileged write operations (creating exams, uploading scans, deleting data) are restricted to workspace owners and teachers; viewers are read-only by policy.

Exam scans, exam assets, and generated reports are stored in private buckets — never on public URLs. Access is granted through short-lived signed links scoped to a single file.

Write access to storage buckets is restricted to owners and teachers of the workspace that owns the file.

Sign-in supports email/password and Google OAuth. Passwords are hashed by our authentication provider; we never see them in cleartext.

We enforce minimum password length and offer leaked-password protection (HIBP check) on the email/password flow. Sessions are short-lived and renewed via refresh tokens stored in browser local storage.

Our database provider takes encrypted point-in-time backups with a 30-day retention window. Backups inherit the same access controls as production data.

On workspace deletion, application data is removed promptly and falls out of backups within the standard backup window.

We monitor application and infrastructure logs for anomalies. In the event of a personal-data breach, we will notify affected controllers (the schools using Excellent) without undue delay and, where feasible, within 72 hours of becoming aware — consistent with GDPR Art. 33.

Controllers remain responsible for notifying their own supervisory authority and data subjects where required by law.