Legal
Security
The technical controls that keep teacher and student records safe in AralSync.
Security is built into how AralSync stores and moves data. Records stay on the teacher’s device by default, sync between authorized devices over an encrypted channel, and are encrypted both in transit and at rest when cloud backup is enabled.
This page summarizes our controls. The full, authoritative detail is in Privacy Policy, Section 5 (Data Storage & Security).
Core Security Controls
- Encryption in transit: TLS 1.2 or higher for all cloud sync and backup
- Encryption at rest: AES-256 for cloud-stored backups
- Password protection: bcrypt hashing; plain-text passwords are never stored
- Short-lived sessions: JWT access tokens expire after 15 minutes; refresh tokens rotate on each use
- Device binding: tokens are tied to the registered device; failed-login limits block brute-force attempts
- Role-based access control: teachers see only their own classes; sensitive notes limited to advisory teachers and admins
- Immutable audit logs: all create/modify/delete events logged with user ID and timestamp, referencing record IDs only
Reporting a Vulnerability
If you discover or suspect a security vulnerability affecting AralSync, report it immediately to security@aralsync.com with the subject line "Security Incident Report." We treat all security reports as high priority.
For our breach-response timeline and notification commitments, see Privacy Policy, Section 10.