Security
ClassPe protects students and parents' details with layers: an app-lock PIN offered at signup and authenticator-app sign-in the owner can switch on, separate data for every institute, payment records that cannot be edited, and an owner-visible security log.
Sign-in
The steps below match the defaults for a new institute.
Layers
Standard time-based six-digit codes (RFC 6238) that work with common authenticator apps. Each code works once, ten one-time recovery codes are kept hashed, and the authenticator secret is encrypted before it is stored. The owner can switch it on.
A four-digit PIN that locks the app each time it opens and after a minute away. Obvious PINs such as 1111 or 1234 are refused, the PIN is checked on our server rather than on the phone, and five wrong tries end the session.
Sign-in, password-reset, one-time-code, MFA and PIN requests are rate-limited. A stricter per-account lockout switches on when the owner sets a security policy.
Every student, fee and attendance query is scoped to the signed-in institute on the server, and we test that another institute cannot reach your records. A number or id sent from the browser is never trusted.
Payment records are never edited. A wrong one is cancelled and entered again, so the history stays intact, and each entry records who made it.
Passwords are kept only as a salted one-way hash. The session cookie is HttpOnly and Secure, and changing your authenticator or PIN signs you out everywhere else.
Everything between your phone and ClassPe travels over HTTPS. Responses carry no-cache headers so an intermediary cannot show yesterday's balance.
Hiding a screen is never the only control. One security gate in front of every request refuses access until the required sign-in steps are done, so a half-finished sign-in cannot reach students and parents' data.
The owner can read a log of sign-ins, authenticator and PIN set-ups, failed attempts, lockouts, resets and policy changes, and can reset a colleague's authenticator or PIN.
Defaults
| Authenticator-app sign-in (MFA) | Off to start: the owner can switch it on |
|---|---|
| App-lock PIN | Off to start: the owner can switch it on |
| App locks again after | 60 seconds away from the app, and every time it is opened fresh |
| Account lockout | Switches on when the owner sets a security policy. Sign-in attempts are rate-limited from the start |
| Who can change these | The institute owner, from the Sign-in security screen |
If you think you have found a weakness, email support@classpe.in with what you found and how to reproduce it. Please give us time to fix it before you share it. Our contact details are also published in security.txt.
Yes. Sign-in can require a six-digit code from an authenticator app after the password, with one-time recovery codes in case a phone is lost. The institute owner can switch it on.
A four-digit PIN that locks the app each time it is opened and after a minute away. It stops a lost or borrowed phone from opening students and parents' details. The PIN is checked on the server, and five wrong tries end the session so the person must sign in again with their password.
Sign in on another device with your password and one of your recovery codes, then set up the authenticator again. If you have no recovery code, the owner can reset a colleague, and the platform team can reset an owner.
No. Every record belongs to one institute, every request is checked against the signed-in institute on the server, and we test that access across institutes is refused.
No. Payment records are never changed. A mistake is cancelled and entered again, so there is always a trail of what happened and who did it.
No. Your password is stored only as a salted one-way hash, so it cannot be turned back into the password.
Email the address on this page or see our security.txt file. Please include what you found and how to reproduce it, and give us time to fix it before you share it publicly.
Create your institute's account, add your batches and admit your first student. Free to try for 2 weeks, no card needed.
Start free trial