Security Policy

CyberCraft Bangladesh is committed to protecting the security and integrity of all data processed through scholina — Education Management System. We implement industry-standard security measures aligned with ISO 27001, OWASP ASVS Level 2, and Bangladesh ICT Division guidelines.

• JWT-based authentication with short-lived access tokens (15 minutes) and secure refresh tokens (7 days).
• Role-based access control (RBAC) with 10+ granular role types and per-user permission overrides.
• Multi-tenant isolation ensures institutions can only access their own data.
• Account lockout after 5 failed login attempts with progressive delay.
• Password requirements: minimum 8 characters with complexity rules.
• Optional multi-factor authentication (MFA) for administrator accounts.

• All data in transit is encrypted using TLS 1.3 with strong cipher suites.
• Data at rest is encrypted using AES-256 encryption.
• Database connections are secured through PgBouncer with SSL enforcement.
• Sensitive fields (NID numbers, bank details) are additionally encrypted at the application layer.
• Encryption keys are managed using industry-standard key management practices and rotated regularly.

• Servers are hosted in secure data centers with 24/7 physical security.
• Network segmentation isolates application, database, and cache layers.
• Web Application Firewall (WAF) protects against common web attacks.
• DDoS protection is implemented at the network edge.
• Regular vulnerability scanning and penetration testing.
• Automated security patching for operating systems and dependencies.

• Protection against OWASP Top 10 vulnerabilities including SQL injection, XSS, and CSRF.
• Input validation and sanitization on all user inputs using Zod schemas.
• Rate limiting on authentication and API endpoints.
• Content Security Policy (CSP) headers to prevent code injection.
• Secure cookie configuration with HttpOnly, Secure, and SameSite flags.
• Regular code reviews and static application security testing (SAST).

• Comprehensive audit logging of all administrative actions.
• Real-time monitoring of system health, performance, and security events.
• Automated alerting for suspicious activities and anomalous behavior.
• Audit logs are immutable and retained for a minimum of 12 months.
• Regular review of access logs and permission assignments.

The scholina — Education Management System desktop application uses RSA-2048 signed license keys with device fingerprinting. Each license is bound to specific devices with a configurable device limit. A 3-day offline grace period allows continued use during internet outages. Licenses can be remotely revoked in case of compromise.

• CyberCraft Bangladesh maintains a documented incident response plan.
• Security incidents are classified by severity (Critical, High, Medium, Low).
• Critical incidents trigger immediate response within 1 hour.
• Affected institutions are notified within 72 hours of a confirmed data breach.
• Post-incident reviews are conducted to prevent recurrence.

If you discover a security vulnerability in scholina — Education Management System, please report it responsibly to [email protected]. We appreciate the security research community's efforts and will acknowledge valid reports. We request that you do not publicly disclose vulnerabilities until we have had reasonable time to address them.