Security & data protection

Waka Wetereo holds learning records and the shop holds order records, so we treat security as a feature. This page summarises the controls in place.

In transit and at rest

• All traffic is served over HTTPS/TLS; HTTP is redirected.
• Strict transport security, frame-ancestor limits and a content security policy are applied to every response.
• Databases, backups and uploaded files are encrypted at rest by our infrastructure providers.

Accounts and access

• Passwords are salted and hashed; we never store or display them.
• New passwords are checked against known breach lists and rejected if exposed.
• Two-factor authentication (authenticator app) is mandatory for every administrator.
• Repeated failed sign-ins pause sign-in for that email and trigger an alert email.
• Sign-ins from a device we haven't seen before trigger an alert email.
• Administrators can end all their sessions on every device at once.

Authorisation

• Every database table uses row-level authorisation: a request can only read the rows that belong to it, enforced by the database rather than the app.
• Administrator rights are stored separately from profiles, so they cannot be self-assigned.
• Course files live in a private bucket and are only served through short-lived signed sessions.

Payments

Card details are captured and stored by Stripe (PCI DSS Level 1). Our systems never receive the card number, and refunds are issued through Stripe's API.

Monitoring and audit

• Administrative actions are written to an append-only audit trail that admins cannot edit.
• Sign-in activity is retained for 12 months for investigation.
• Sensitive and expensive endpoints are rate-limited per IP and per account.
• Community content is screened automatically for harmful or abusive material.

Uploads

Course packages are validated before storage: SCORM manifest checks, path traversal rejection, blocked executable file types, and per-file and per-package size limits.

Incident response

If we ever detect a privacy breach that is likely to cause serious harm, we will contain it, notify affected people, and notify the Office of the Privacy Commissioner as soon as practicable, as required by the Privacy Act 2020.

Reporting a vulnerability

Found something? Email kiaora@mindyourtongue.co.nz. We'll acknowledge within 2 working days and won't pursue researchers acting in good faith. See also our privacy policy.