Security
Shine protects data with encrypted connections, access rules that keep each organisation's data separate, individual staff logins and an audit trail for council reporting.
How data is protected
- Encrypted connections. The site is only served over HTTPS.
- Access rules in the database. Each account can only read the records its role allows. Young people see their own records; school and college staff see their own institution; council staff see their own council's totals.
- Separate council and education accounts. A council account cannot join a school or college, and council screens never receive learner-level data.
- Individual logins. Every staff member signs in with their own account. Council invitations go to a named email address and expire after 14 days.
- Audit trail. Council reporting actions, such as invitations, schedule changes and reopened returns, are logged.
Report a security concern
If you think you have found a security problem, email contact@shineai.tech with the subject "Security concern". Please include what you found and how to reproduce it, and do not access other people's data.
Our contact details are also published in the standard security.txt file.