Security

Last updated: 15 August 2026

You are uploading work that may represent years of effort. Here is what we do to keep it safe — stated plainly, so you can judge for yourself.

Your document

Encrypted in transit. Every page and upload uses HTTPS (TLS). Plain HTTP is not served.
Encrypted at rest. Data lives on our hosting provider's encrypted persistent storage.
Only you and your reviewers can open it. Students see only their own submissions; institutional reviewers see only their own institution's submissions; Institute staff access is role-restricted and logged.
Never published. Your document is used to produce your report and, if approved, held for comparison. It is never made public, sold, or shown to other students. Certificate verification shows only the public certificate record, never the text.
Never used to train AI. We do not use your work to train any AI model.

Your account

Passwords are stored only as a salted one-way bcrypt hash — we cannot read them, and neither could anyone who obtained the database.
Sessions use signed tokens (JWT) with a server-side secret that is generated by the hosting platform and never stored in code.
Password reset links expire and can be used once. Institution and admin accounts are separated by role.

Payments

All payments are processed by Paystack, a PCI-DSS Level 1 certified provider licensed by the Central Bank of Nigeria. Your card, bank or USSD details are entered on Paystack's secure page and never touch our servers. We store only the payment reference, amount and status.
Payment confirmation is verified server-to-server with Paystack, not trusted from the browser.

Platform

Hosted on Render (Frankfurt region) with automatic TLS, health-checked deployments and daily disk snapshots (7-day rolling).
Standard web hardening headers (Helmet), request rate limiting, and input validation on every endpoint.
Secrets (payment keys, signing keys, API keys) are held in the platform's encrypted environment settings, never in the source code repository.
Heavy document checks run in isolated worker threads so a malformed file cannot take down the service for others.

Tamper-evident audit trail

Every account action, payment, check, decision, certificate and deletion is written to a hash-chained audit log: each entry carries a cryptographic fingerprint of the entry before it, so records cannot be silently altered or back-dated. This is what makes an Intelliscan verdict defensible if it is ever questioned.

Certificates

Every Certificate of Originality has a unique ID and a QR code that resolves to /verify/<ID> on this domain. Anyone can confirm a certificate is genuine in seconds; a certificate that has been withdrawn or whose submission was deleted returns “not found”.

Third parties we rely on

Provider	Purpose	What they receive
Render	Hosting & storage	The service and its encrypted data
Paystack	Payments	Your email, amount, payment reference (you enter card details directly with them)
Email delivery provider	Result, receipt and password emails	Your email address and the message content
Web-search provider	Finding public sources on the open web	Short distinctive excerpts of the text (never the whole document)
Anthropic	Optional AI Rewrite Coach	Only the passage you choose to have re-worded, only when you click the button

If something goes wrong

We follow the NDPA breach-notification rule: if a security incident affects your personal data, we notify the Nigeria Data Protection Commission within 72 hours and tell affected users promptly, with clear guidance on what to do.

Report a vulnerability

If you believe you have found a security weakness, please email info@intelliscanstandardsinstitute.org with “Security report” in the subject. We will acknowledge within 2 working days. Please do not access other people's data or disrupt the service while testing.