Security

Safe email display

• Every HTML message is sanitised and shown in an isolated frame that cannot run scripts
• Remote images (used to track when you open a message) don't load until you allow them
• Links open in a new tab without sending the page address

Accounts

• Passwords are hashed with PBKDF2 and a unique salt
• Sign-in locks for a while after repeated failures
• Changing your password signs out every other device
• Operator access requires two-step verification, confirmed again every 12 hours

Organisations are kept apart

Every request can reach only its own organisation's data. Automated tests try every API route with another organisation's identifiers to make sure nothing leaks.

Infrastructure

• HTTPS everywhere
• Daily encrypted backups with an automatic restore drill
• Admin actions recorded in an audit log

Reporting a vulnerability

If you find a security problem, please tell us at security@nsut.org. We reply within 3 working days; please keep it private until it is fixed.