Security
Your data is
not an afterthought.
CodeSpell handles sensitive academic data — student submissions, grades, identifiers. We take that seriously. Here's exactly what we do to protect it.
How we protect your data
Security by design,
not by checkbox.
Encryption everywhere.
All data in transit is protected with TLS 1.2 or higher. Some data at rest is encrypted with AES-128. Encryption keys are managed via a dedicated key management service and rotated annually.
Access control.
Production systems are accessible only to limited authorised personnel. Role-based access control limits what any individual can see or modify. All access is logged and reviewed.
Secure development lifecycle.
Security is integrated into every phase of our development process. We conduct regular code reviews, static analysis, and use secure coding practices.
Vulnerability management.
We run automated dependency scanning on every build. Critical and high CVEs are patched within 48 hours. We use third-party tools to monitor for new vulnerabilities in our stack and respond accordingly.
Incident response.
We maintain a documented incident response plan. In the event of a data breach affecting your institution, we will notify you within 72 hours of discovery, consistent with GDPR and applicable US state laws.
Responsible disclosure.
We welcome security researchers. If you discover a vulnerability, please report it to security@codespell.net. We commit to acknowledging reports within 2 business days and resolving confirmed issues promptly.