Security

Aletive is used by students, so protecting their data is our first job. Here's exactly how.

Your account

• Every account is confirmed with a 6-digit code sent to your email. Codes are random, expire after 10 minutes, work once, and stop working after 5 wrong tries.
• Passwords are never stored. We keep a salted PBKDF2-SHA256 hash (100,000 rounds), and reject common passwords.
• Teachers and admins also need a fresh emailed code every time they sign in, because they can see student data.
• Sign-in, sign-up, codes and resets are rate-limited per device and per email, with a check after repeated failed sign-ins.
• Answers never reveal whether an email has an account.

Your data

• Emails, names, school names, class names, cloud backups, shared progress and school requests are encrypted with AES-256-GCM before they're stored, each bound to its own record.
• Emails are looked up by a keyed hash, so a copy of the database alone doesn't reveal anyone's address.
• Students share only study statistics with their teachers, and only after joining a class. Never notes, answers or messages.
• You can download everything we hold about you, and delete your account and all its data in one click.

The app and the website

• The desktop app keeps its sign-in token encrypted by Windows and never exposes it to the page.
• The website sends a strict Content-Security-Policy, HSTS, and refuses to be framed. Sign-in cookies are HttpOnly, Secure and SameSite=Strict.
• Every request is checked on the server: who you are, what your role is and whether the data is yours or your class's.
• No adverts, trackers, analytics or third-party scripts.

Who processes data for us

Cloudflare (hosting and database) and Resend (sending emails). Both only process data to provide those services.

Report a problem

If you think you've found a security issue, email contact@aletive.com with the subject "Security". Please don't access other people's data or disrupt the service while testing. We'll reply within three working days.