Security & data protection

Waka Wetereo holds learning records and the shop holds order records, so we treat security as a feature. This page summarises the controls in place.

In transit and at rest

• All traffic is served over HTTPS/TLS; HTTP is redirected.
• Strict transport security, frame-ancestor limits and a content security policy are applied to every response.
• Databases, backups and uploaded files are encrypted at rest (AES-256, provider-managed keys) by our infrastructure providers, Supabase and Lovable.

Backups, recovery and deletion

• Encrypted backups and point-in-time recovery are managed by our platform providers.
• When you delete your account or content it is removed from the live database immediately; copies in encrypted backups age out automatically as backups cycle (within about 30 days).
• Sales and GST records are retained for 7 years as Inland Revenue requires, even after account closure — see the retention table in the privacy policy.

Accounts and access

• Passwords are salted and hashed; we never store or display them.
• New passwords are checked against known breach lists and rejected if exposed.
• Two-factor authentication (authenticator app) is mandatory for every administrator.
• Repeated failed sign-ins pause sign-in for that email and trigger an alert email.
• Sign-ins from a device we haven't seen before trigger an alert email.
• Administrators can end all their sessions on every device at once.

Authorisation

• Every database table uses row-level authorisation: a request can only read the rows that belong to it, enforced by the database rather than the app.
• Administrator rights are stored separately from profiles, so they cannot be self-assigned.
• Course files live in a private bucket and are only served through short-lived signed sessions.

Payments

Card details are captured and stored by Stripe (PCI DSS Level 1). Our systems never receive the card number, and refunds are issued through Stripe's API.

Monitoring and audit

• Administrative actions are written to an append-only audit trail that admins cannot edit.
• Sign-in activity is retained for 12 months for investigation (see the retention table in our privacy policy).
• Sensitive and expensive endpoints are rate-limited per IP and per account.
• Community content is screened automatically for harmful or abusive material. Flagged content is reviewable by a human administrator, and you can appeal any moderation decision by emailing us — a person makes the final call.
• Course files are served only through short-lived signed sessions, and issuance of those sessions is tied to an authenticated, paying member.

Uploads

Course packages are validated before storage: SCORM manifest checks, path traversal rejection, blocked executable file types, and per-file and per-package size limits.

Incident response

We maintain a written breach-response plan. If we detect a suspected breach we record and contain it immediately, assess the likelihood of serious harm, and — where serious harm is likely — notify both the Office of the Privacy Commissioner (via the NotifyUs tool) and the affected people directly, as soon as practicable, as required by Part 6 of the Privacy Act 2020.

Reporting a vulnerability

Found something? Email kiaora@mindyourtongue.co.nz. We'll acknowledge within 2 working days.

Scope and safe harbour: test only against your own account and data; do not access, alter or delete anyone else's information, do not disrupt the service, and do not use automated scanners at a volume that degrades it. Researchers acting in good faith within this scope will not face legal action from us. See also our privacy policy.