Security

How we protect accounts

• Login is by ID card number + password. Passwords are stored as one-way hashes.
• You can add a passkey (fingerprint, face or security key) in your profile — it signs you in without a password ever travelling over the network. We store only its public key; the private key never leaves your device.
• Sessions expire after inactivity and are fully invalidated on logout.
• Login attempts are rate-limited to slow down guessing attacks.
• Every login, password change and administrative action is written to a security audit log.

How we protect data

• ID card numbers are encrypted in our database and masked everywhere they are displayed.
• Test questions, timers and scoring run on our servers — results cannot be altered from the browser.
• Staff access is limited by role, and sensitive lookups (such as viewing a full ID card number) are logged and restricted to senior staff.
• The website carries no third-party trackers or advertising scripts.

What you should do

• Use a password you don't use anywhere else, and never share it — not with friends, not with staff.
• Log out when you're done, especially on shared or public devices.
• We will never ask for your password by phone, WhatsApp or email. Anyone who does is not us.

Report a problem

If you notice suspicious activity on your account, or you find a security weakness in the website, tell us directly via the contact page and ask for the office. Please don't publish the details publicly before we've had a chance to fix them.

We describe our practices in general terms on purpose — publishing implementation details would make the platform easier to attack.