Security Practices
This page describes the security controls implemented in EduLynx ERP. Every control listed here is part of the production system today.
EduLynx ERP handles sensitive institutional data — student records, financial information, staff details and operational metrics. Security is built into every layer of the platform.
Implemented Security Controls
Each control listed below is implemented and active in the production environment.
JWT Authentication
Token-based authentication using JSON Web Tokens with access and refresh token rotation.
- Short-lived access tokens for API authorisation.
- Refresh token rotation to limit the window of token compromise.
- Tokens are validated on every API request.
- Token expiry and invalidation on logout.
Multi-Factor Authentication
TOTP-based multi-factor authentication with recovery codes for account protection.
- Time-based One-Time Password (TOTP) compatible with standard authenticator apps.
- Recovery codes generated during MFA setup for account recovery.
- MFA can be enforced for administrative and sensitive roles.
Role-Based Access Control
Granular permission model that restricts data and functionality access based on assigned roles.
- Predefined roles with specific permission sets.
- Each API endpoint and UI view checks user permissions before granting access.
- Users see only the data and actions their role permits.
- Role assignments are auditable.
Multi-Tenant Data Isolation
Each institution operates in complete data isolation within the multi-tenant architecture.
- Tenant context is enforced on every database query.
- One institution cannot access another institution's data.
- Tenant isolation applies to all modules including AI queries.
- Separate institutional settings, users and configurations.
Password Security
Passwords are hashed using bcrypt with appropriate cost factor before storage.
- Bcrypt hashing with per-password salts.
- Plain-text passwords are never stored or logged.
- Server-side validation of password requirements.
Server-Side Secrets
API keys, database credentials and sensitive configuration are stored as server-side environment variables.
- Secrets are never included in client-side bundles or browser-accessible code.
- Anthropic API keys for the AI feature are server-side only.
- Environment-based configuration for different deployment stages.
HTTPS & Transport Security
All communication between clients and the server is encrypted using HTTPS.
- TLS encryption for all data in transit.
- HTTP Strict Transport Security (HSTS) header enforced.
- Secure cookie attributes where applicable.
Security Headers
HTTP security headers are configured to protect against common web vulnerabilities.
- X-Frame-Options to prevent clickjacking.
- X-Content-Type-Options to prevent MIME-type sniffing.
- X-XSS-Protection for legacy browser XSS filtering.
- Referrer-Policy to control information leakage in referrer headers.
- HTTP Strict Transport Security (HSTS) to enforce HTTPS connections.
Audit Logging
Significant actions are recorded with timestamps, actors and details for accountability and investigation.
- User actions including logins, data changes and administrative operations are logged.
- Each log entry includes the user, timestamp and action details.
- Audit logs support investigation and compliance review.
Security Event Monitoring
Security-relevant events are monitored and recorded for detection and response.
- Failed login attempts are tracked.
- MFA events (setup, verification, failures) are recorded.
- Unusual access patterns can be identified through logged events.
Rate Limiting
API rate limiting is implemented to protect against brute-force attacks and abuse.
- Request rate limits on authentication endpoints.
- Protection against credential stuffing and brute-force login attempts.
CORS & Proxy Configuration
Cross-Origin Resource Sharing and proxy headers are configured to control access to API endpoints.
- CORS policies restrict which origins can access the API.
- Proxy headers are configured for correct client identification behind reverse proxies.
Continuous Improvement
Security is an ongoing process. We review and update our security practices as the platform evolves, as new threats emerge and as best practices develop. This page reflects the current state of implemented controls.
If you have security questions or wish to report a security concern, contact us at founder@krislynx.com.
Secure School Management
See how EduLynx ERP keeps your institutional data protected. Request a demo to learn more about our security architecture.