Trust & Security

Sign-in is handled by Supabase Auth. Passwords are salted and hashed with bcrypt; the plain password is never stored. New and changed passwords are checked against the Have I Been Pwned breach database to reject known-compromised credentials.

Every database table uses Row Level Security. Students see only their own work; parents see only students explicitly linked to them; tutors see only students assigned to them; administrators have full access for support. Roles are stored in a dedicated table — not on the user profile — so a user cannot escalate themselves.

All traffic is encrypted in transit using TLS 1.2 or higher. Database storage and automated backups are encrypted at rest by the infrastructure provider.

Numera runs on Supabase (managed PostgreSQL + Auth) and Cloudflare's edge network. The primary database and its backups are hosted in the European Union.

The database is backed up automatically every 24 hours. Point-in-time recovery is available for the most recent 24 hours. Backups are retained for 7 days, encrypted, and stored in the same region as the primary database.

Live updates (bookings, worksheet attempts, assignments) flow over authenticated websocket channels. Anonymous clients cannot subscribe.

Numera is designed for KS3–KS4 pupils. Accounts for under-18 users require parental consent. Parents can withdraw consent and request deletion at any time via Privacy.

Signed-in users can request a data export or account deletion from Settings → Privacy. We action requests within 30 days, as required by UK GDPR Articles 15 and 17.

Card data is handled entirely by Stripe (PCI DSS Level 1). Numera only stores the Stripe customer and subscription identifiers needed to manage the subscription.

To report a security issue, email security@numeramaths.com. We aim to acknowledge reports within 2 business days.