Security

How we protect your data

• Encryption in transit: HTTPS everywhere, with HSTS.
• Passwords: hashed with argon2id (memory-hard). We never see or store your password.
• Sessions: random 256-bit tokens in HTTP-only, secure, SameSite cookies. Only a hash is stored, so a database leak can't be used to sign in. Sessions expire after 7 days idle or 30 days in total, and you can end any of them from Settings.
• Isolation: every query is scoped to your account on the server. Search, exports and file access never cross accounts, and automated tests check this for every kind of record.
• Abuse protection: layered rate limits on sign-in, sign-up, password reset, uploads, imports and exports, at both the web server and the application.
• Browser protections: a strict per-request Content-Security-Policy, framing disabled, no third-party scripts.
• Uploads: content-type verified from file bytes, size and page limits, private storage, deleted after review.
• Infrastructure: the database isn't exposed to the internet. Backups are encrypted, rotated and access-controlled.
• Audit trail: sign-ins, imports, exports and deletions are logged, with IP addresses stored only as keyed hashes.

Portal credentials

Acadex will never ask for your SRM Academia or Student Portal password, OTP or session cookie, and has no feature that logs in to those systems. If anyone asks for them in Acadex's name, don't share them, and please let us know.

Reporting a vulnerability

A security contact hasn't been configured for this deployment yet. Once it is, it'll appear here and in /.well-known/security.txt.