Security | CodeSaudi

Our Security Commitment

At CodeSaudi, security is not a feature. It is the foundation of everything we build. We handle the data of children and families with the highest standards of protection, and we commit to internationally recognized security practices at every layer of the platform.

HTTPS & Encryption in Transit

All communication between your browser and our servers is secured with HTTPS using TLS 1.2+. Every piece of data that travels between your device and our platform, including passwords, personal information, and session tokens, is fully encrypted and cannot be intercepted.

• TLS certificates issued by trusted authorities and auto-renewed.
• Automatic HTTP → HTTPS redirect on all routes.
• HTTP security headers enabled (HSTS, CSP, X-Frame-Options).

Two-Factor Authentication (2FA)

Two-factor authentication is available for all platform accounts. When enabled, anyone trying to access your account needs both your password and a time-sensitive code sent to your phone or authenticator app, making unauthorized access dramatically harder.

• TOTP app support (Google Authenticator, Authy, and others).
• Instant alerts for suspicious login attempts.
• Session management to review and revoke connected devices.

Encrypted Data at Rest

All data stored in our databases and backups is encrypted using AES-256, the industry gold standard for data-at-rest encryption. Even in the unlikely event of physical server access, no data can be read without the encryption keys.

• Full encryption of primary databases and all backups.
• Passwords hashed with bcrypt, never stored in plain text.
• Uploaded files (images, documents) encrypted in cloud storage.

Role-Based Access Control (RBAC)

Every user on the platform (student, parent, teacher, or administrator) has strictly scoped permissions. No user can access another user's data without explicit authorization.

• Student: accesses only their own learning resources and progress.
• Parent: sees reports for their linked children only.
• Teacher: accesses data of students in their assigned groups only.
• Admin: administrative permissions scoped to their organization.
• Regular access reviews and full audit logs for sensitive actions.

Infrastructure Security

Our platform is hosted on cloud infrastructure certified to the highest security standards.

• Servers in ISO 27001-certified data centers.
• Firewalls and isolated VPC networks.
• 24/7 continuous system monitoring.
• Automatic security patches for software and operating systems.
• Daily encrypted backups with regular restoration testing.

Incident Response

We maintain a clear incident response plan for any security event. In the event a breach is detected, we commit to notifying affected users within 72 hours in accordance with Saudi Arabia's Personal Data Protection Law (PDPL).

Report a Vulnerability

We welcome security researchers and users who discover potential vulnerabilities. If you find something concerning, please contact us directly before any public disclosure so we can address it responsibly.

Security email: support@codesaudi.online

We commit to responding to all vulnerability reports within 48 hours and genuinely appreciate efforts that help make our platform safer.