Security
Last updated: August 2026
We take the security of your data seriously. This page describes how XCBT protects your information and what you can do to help.
1. Platform Security
- Encryption in transit: all traffic is served over HTTPS with enforced redirects (HSTS).
- Password storage: passwords are hashed with bcrypt (12 rounds) and never stored in plain text.
- Tenant isolation: every request is verified against the signed-in school so users cannot access another school's data.
- Access control: role-based permissions (super admin, school admin, teacher, student, parent, tutor) with verified email addresses.
- Brute-force protection: login attempts are rate-limited per account and per device.
- Upload protection: file uploads are restricted by type, and executable files cannot run from upload storage.
- Dependency hygiene: framework and third-party packages are kept up to date and scanned for known vulnerabilities.
- Monitoring: production errors and failed background jobs generate automatic alerts to our operations team.
2. Payment Security
Online payments are processed by Monnify, a PCI-DSS compliant payment processor. Card details never touch our servers. Bank-transfer payments require an uploaded receipt verified by our administrators before activation.
3. Exam Integrity
When enabled by your school, exam sessions may be proctored using activity logs and webcam snapshots. This data is visible only to your school administrators and is used solely to uphold exam integrity.
4. Your Part
- Use a strong, unique password and enable two-factor authentication where offered.
- Never share your login credentials or leave a signed-in session unattended.
- Report suspicious activity to your school administrator or to us immediately.
5. Reporting a Vulnerability
If you believe you have found a security weakness, please report it responsibly to security@xcbt.ng. We will acknowledge within 72 hours and keep you informed of our resolution. Please do not publicly disclose an issue before we have addressed it.