Security

1. Our approach

Students and teachers trust Tausi with exam results, class lists and uploaded notes. We protect that information by design: every request is checked, every account sees only what it should, and we collect as little as we can.

2. Your account

• Passwords are never stored by Tausi — our authentication provider stores only a salted hash.
• New passwords need at least 10 characters with letters and numbers, and well-known passwords are refused.
• Every signed-in request carries a signed session token that is verified before any data is returned; anything that cannot be verified is treated as signed out.
• Sign-in links only ever send you to pages on tausi.app.

3. Who can see what

Database rules (row-level security) enforce access on every query, not just in the app: a student sees their own results; a teacher sees only the classes they teach; private classes are visible only to their members. Guests in quick games use only a display name.

4. Data in transit and at rest

• All traffic uses HTTPS with HSTS, so browsers refuse unencrypted connections to Tausi.
• Stored data and files are encrypted at rest by our database and storage provider.
• Uploaded files are private and reachable only by their owner (or the class they were shared with).

5. Protections in the app

• A strict Content Security Policy and anti-framing headers block injected scripts and clickjacking.
• Requests from other websites cannot change your data (cross-site request forgery checks).
• Rate limits slow down automated abuse of sign-in, uploads and AI features.
• Uploads are checked by their actual contents — only PDFs and images are accepted — and size-limited.
• Every form and API input is validated on the server.
• AI service keys stay on our servers and are never sent to your browser.

6. Reporting a vulnerability

If you think you have found a security issue, please email support@tausi.app with the steps to reproduce it. Please do not access other people’s data, disrupt the service, or share the issue publicly before we have fixed it. We will acknowledge your report and keep you updated.