Security

Reporting a vulnerability

If you believe you have found a security problem, tell us before telling anyone else. Send the details, including the steps needed to reproduce it, through the contact page and mark it as a security report.

We will acknowledge the report, keep you updated while we investigate, and credit you if you would like to be credited. Please do not access or modify data belonging to other people while testing, and do not run automated scans against production.

Authentication

Access tokens are short-lived and held in memory rather than persisted, which limits their exposure. A longer-lived refresh token is used to obtain new access tokens, and a failed refresh ends the session.

Passwords are stored using a one-way hash. Nobody at LatinSync Central can read your password.

Separation between studios

The platform is multi-tenant, and every request is authorised against the studio it targets and the role of the user making it. A studio administrator cannot reach another studio’s records, and a student can reach only their own.

Payment data

Card details go directly from the payer’s browser to Stripe and never reach our servers, so the systems we operate hold no card numbers. Stripe is responsible for the card data environment and maintains its own certifications.

Data in transit

All traffic to the application is served over HTTPS. Requests to the API are authenticated, and tokens are validated on every request rather than trusted from the client.

What is still to come

We would rather state this plainly than imply more than is in place. Formal third-party certification, a published penetration-test summary and customer-managed audit logging are not in place today. When they are, they will be listed here with dates.

Questions about this document can be sent to [COMPANY LEGAL NAME] at [REGISTERED ADDRESS], or through the contact page.