Security & Privacy Controls
MathsExpress v10.0.0 includes technical controls intended to support a school-ready deployment. This page is not a certification.
Controls in the application
- Authenticated Supabase access and role/class/school permissions.
- Row-level database security and restricted RPC patterns.
- Server-side storage of AI/integration secrets.
- Content Security Policy with dynamic
eval/new Functionremoved from maths evaluation. - HSTS, frame/object restrictions, restrictive browser permissions and no-referrer headers for hosted deployments.
- Audit/integrity records, rate limits and duplicate reward protections.
- Privacy request workflow and configurable retention objects in the v9 migration.
Current production status
Not production-approved. The packaged client configuration is intentionally set to environment: development and schoolProductionApproved: false. The app now reads these flags: hosted school onboarding and external write actions are blocked while production approval is off, while production approval is off. Local development can still test integrations when explicitly allowed in the config.
Required before production
- BLOCKING: Dedicated MathsExpress production database, separate from unrelated apps.
- BLOCKING: Leaked-password protection, staff/admin MFA, trusted email/SSO configuration.
- BLOCKING: Manual audit of privileged database functions and least-privilege grants.
- BLOCKING: Tested backups/restores, monitoring, incident response and release rollback.
- BLOCKING: Independent security review/pen-test appropriate to the rollout.