Security
Each school's data is kept apart
Every table that holds school data is protected by row-level security (RLS) in the database. Teachers, parents and school administrators can only see and change data from their own school.
Encrypted connections
All traffic to MyDugsi goes over HTTPS (TLS), and browsers are told to always use HTTPS (HSTS). Connections to the database from outside are refused unless they are encrypted.
Locked after three wrong attempts
After three wrong passwords in a row, the account is locked for 15 minutes. This applies on the website and in the app.
Nightly backups
The database is backed up automatically every night.
Where the data lives
The database, the nightly backups and the app run on servers in the EU.
No open sign-up
A new dugsi is set up only after we have reviewed its application. Nobody can create a school or an administrator account directly from the website.
One dependency reaches outside the EEA
Hosting and application traffic stay inside the EU, on servers in the EU. Parent notifications do not: they are delivered through the WhatsApp Business API, and their content — child name, class, attendance, lesson scores, parent name and phone number — is processed by WhatsApp outside the EU/EEA, including in the United States. The full disclosure is on the privacy page.
Found a security issue?
Write to kontakt@mydugsi.com and describe what you found.