Our Security Commitment
Educational Bloom is built to protect the data of Nigerian students, parents, and schools. We apply security controls across every layer of the platform — from how passwords are stored to how Firestore database rules are written and tested. This page describes what we do, how we do it, and how to report a concern.
Authentication & Access
Password Storage
All passwords are hashed using SHA-256 via the Web Crypto API before being written to Firestore. Plaintext passwords never leave the user's device. Legacy plaintext passwords are automatically migrated on first login.
Role-Based Access Control (RBAC)
Four roles exist within every school account. Access is enforced at two layers:
- Principal — full access to all school data
- Bursar — fee data only, no scores or staff records
- Class Teacher — assigned class only, no fee visibility
- Subject Teacher — assigned subjects only
Client-side gates (JavaScript) prevent navigation. Server-side Firestore rules enforce the same restrictions on all database reads and writes — bypassing the app via browser console or API does not grant access.
Session Management
School sessions persist in localStorage with school ID binding. Portal admin sessions expire after 8 hours. Agent sessions persist until manual logout.
Data Protection
What data we store
| Data Type | Who Can Access | Encrypted |
|---|---|---|
| Student names, phone, class | School staff only | In transit (TLS) + at rest (Firebase AES-256) |
| Fee records & payment history | Principal + Bursar only | Same |
| Academic scores | Principal + assigned teacher | Same |
| Attendance records | Principal + class teacher | Same |
| Staff credentials | Principal (hashed passwords) | SHA-256 hashed |
| Agent deal submissions | AariNAT admin only | Same |
Data residency
Data is stored on Google Firebase Firestore. AariNAT has configured the Firebase project in alignment with Google's data processing terms. For NDPA 2023 compliance documentation, contact aarinat.company.limited@gmail.com.
Third-party processors
| Processor | Purpose | Data sent |
|---|---|---|
| Google Firebase | Database, Auth, Hosting | All school records |
| Groq | Score sheet OCR | Register photos (optional feature) |
| HuggingFace | OCR fallback | Register photos (optional feature) |
| OCR.space | OCR fallback 2 | Register photos (optional feature) |
| GitHub Pages | App hosting | No personal data |
The OCR features that send photos externally are PREMIUM features — only active when the school enables score sheet scanning. Raw student names in register photos may be processed by Groq/HuggingFace.
Infrastructure Security
| Control | Status |
|---|---|
| HTTPS / TLS everywhere | ✅ Enforced |
| Firestore security rules | ✅ Active + tested |
| Firestore catch-all default | ✅ DENY (if false) |
| Password hashing (SHA-256) | ✅ Active |
| XSS output encoding | ✅ Active (esc() + apostrophe fix) |
| Commission rate server validation | ✅ Active |
| Automated pentest on every push | ✅ GitHub Actions |
| AI architecture review on every push | ✅ Claude Sonnet |
| Firebase Auth for admin operations | ✅ Portal requires auth |
| Per-school Firebase Auth (RBAC enforcement) | 🔜 In progress |
| DDoS protection | GitHub Pages CDN |
| Multi-factor authentication | ⏳ Planned |
NDPA 2023 Compliance
Educational Bloom operates under the Nigeria Data Protection Act 2023 (NDPA) and is regulated by the Nigeria Data Protection Commission (NDPC).
- Data Controller: AariNAT Company Limited (RC-1732521), Abeokuta, Ogun State
- Lawful basis for processing: Contract (school subscription) + Legitimate interest
- Retention: 24 months after subscription ends, then deletion on request
- Data Subject Rights: Schools may request export or deletion — contact us below
- Breach notification: NDPC notification within 72 hours of discovery
- Cross-border transfers: Firebase EU/US servers — documented under Google's DPA
Reporting a Vulnerability
If you have discovered a security vulnerability in Educational Bloom, please report it responsibly. Do not publish or exploit it.
📧 aarinat.company.limited@gmail.com
📱 WhatsApp: +234 814 507 3941
We aim to acknowledge reports within 48 hours and resolve critical issues within 7 days. Responsible reporters will be credited in our security changelog.
Scope
- In scope school.edubloom.com.ng, agent.edubloom.com.ng, portal.edubloom.com.ng, Firestore rules
- Out of scope Brute-force attacks, social engineering, physical access