The practical stuff that actually protects student data — not a compliance-badge wall.
Every connection — web, mobile app, and API — runs over HTTPS/TLS, terminated at the edge before traffic ever reaches application servers.
JWT access and refresh tokens with short-lived access tokens, so a leaked token has a limited window of use.
Every API route is scoped to specific roles — System Admin, School Admin, Teacher, and so on — enforced on the backend, not just hidden in the UI.
Data is scoped per school throughout the system, so one institution's students, results, and content stay separated from another's.
Uploaded content and app releases live in versioned cloud storage with tightly scoped access policies — nothing is broadly public by default.
The Acuitely Android app is distributed directly rather than through the Play Store, so every release is cryptographically signed with our release key and published with a SHA-256 checksum you can verify — see the download page. Updates are checked for automatically and can be required for versions that fall too far behind, so a security fix doesn't sit unused on old installs.