Security
How we protect accounts and transactions.
Account access, student records and transactions each need a different check. Our controls follow the action from sign-in through confirmation and record access.
Explore this pageThe model
Security follows the action.
A student uploading work, a guardian viewing progress and an adult confirming a purchase face different risks. Permissions, validation and review steps are set at the server boundary for each action.
01 / Identity
Account access
- Email and phone verification for sensitive sign-up and recovery steps.
- Authenticated sessions for private account routes and APIs.
- Password reset checks that require a fresh verification step.
- Session expiry and sign-out to limit access from a shared device.
- Rate limits on public submission and authentication-sensitive endpoints.
02 / Permissions
People and data
- Server-enforced student and adult roles for account activity.
- Age, identity, investor-mode and KYC checks before eligible real-money orders.
- Guardian access limited to the linked student’s permitted progress view.
- Ownership checks for private achievements, plans, uploads and account records.
- Student practice balances isolated from real-money transaction paths.
03 / Transactions
Orders and wallet
- Asset price, amount and fees shown before confirmation.
- Signed, short-lived quotes checked by the server.
- Balance and eligibility checks at transaction time.
- Atomic execution and idempotency keys to avoid duplicate confirmation.
- College Coins kept unpriced and unavailable for purchase, sale or transfer.
04 / Application
Software and files
- Request validation and bounded input sizes on API endpoints.
- Controlled access to original private uploads.
- File type and size checks in upload flows.
- Dependency review and updates as part of release maintenance.
- Separate environments and controlled handling of service credentials.
05 / Data protection
Encryption and handling
- TLS protects data moving between the browser and the service.
- Sensitive records are encrypted at rest and access is limited by role.
- Passwords are stored as salted hashes rather than readable text.
- Private documents are served through authorised download routes.
- Retention and deletion follow the applicable account and legal requirements.
06 / Operations
Monitoring and response
- Service health checks and error logging for investigation.
- Restricted production access and review of sensitive changes.
- Data backups and recovery procedures for critical records.
- Secret rotation and revocation when access needs to change.
- Incident triage, containment and recovery procedures for service disruptions.
07 / Review
Testing and oversight
- Code review before changes reach sensitive account and transaction paths.
- Automated checks for role boundaries, ownership and duplicate transactions.
- Review of third-party services that handle identity, payments or messages.
- Updates to dependencies and follow-up on reported vulnerabilities.
- A direct channel for reporting suspicious activity or a security issue.
For your account
A few things you can do.
Keep verification codes to yourself
A code is for your own sign-in or account action. Intuition support will not ask you to send one in a message.
Check the full address
Open the site directly and read the web address before entering account details. Be cautious with links in messages.
Report unexpected activity
Contact support promptly if you see an action you do not recognise or think an account has been accessed.
Get in touch
Report a security concern.
Tell us what happened and where you saw it. Please leave out passwords, one-time codes and private keys.