Security & Privacy Controls
MathsExpress v9.5.1 includes technical controls intended to support a school-ready deployment. This page is not a certification.
Controls in the application
- Authenticated Supabase access and role/class/school permissions.
- Row-level database security and restricted RPC patterns.
- Server-side storage of AI/integration secrets.
- Content Security Policy with dynamic
eval/new Functionremoved from maths evaluation. - HSTS, frame/object restrictions, restrictive browser permissions and no-referrer headers for hosted deployments.
- Audit/integrity records, rate limits and duplicate reward protections.
- Privacy request workflow and configurable retention objects in the v9 migration.
Current production status
Not production-approved. The packaged client configuration is intentionally set to environment: development and schoolProductionApproved: false. The app now reads these flags: hosted school onboarding and external write actions are blocked while production approval is off, and the app displays a development/test warning. Local development can still test integrations when explicitly allowed in the config.
Required before production
- BLOCKING: Dedicated MathsExpress production database, separate from unrelated apps.
- BLOCKING: Leaked-password protection, staff/admin MFA, trusted email/SSO configuration.
- BLOCKING: Manual audit of privileged database functions and least-privilege grants.
- BLOCKING: Tested backups/restores, monitoring, incident response and release rollback.
- BLOCKING: Independent security review/pen-test appropriate to the rollout.