Security

Last updated: 26 July 2026

A straightforward look at how Scientia protects your account and data — no vague "bank-level security" claims, just what's actually in place.

Authentication

• Passwords are hashed with a per-user salt before storage — Scientia never stores or can see your actual password.
• Login sessions use an HttpOnly, Secure cookie, so it can't be read by page scripts (a common vector for session theft) and is only ever sent over HTTPS.
• Deactivating an account (by the tutor) blocks login immediately, independent of any single course.

Access control

• Every part of the admin panel and every API endpoint checks the logged-in user's role before returning data — a student account cannot reach admin-only data or another student's private information by, for example, guessing a URL.
• Paid course content is locked server-side: it isn't sent to the browser at all unless payment is confirmed, not just hidden with CSS.

Payments

Card payments never touch Scientia's servers — PayFast handles that. Every payment webhook is signature-verified and cross-checked against PayFast's own API before being trusted, which prevents forged "payment successful" requests.

Infrastructure

The platform runs on Cloudflare's network (Pages, D1 database, KV for sessions), which provides HTTPS by default and standard DDoS protection at the network edge.

Reporting a security issue

If you find a security problem, please report it via the Support page rather than testing it further — we'll investigate promptly.