Security
What we do, in plain words.
Fewer copies
The design itself is the first control. A family's documents are stored once, shared with the school, and never emailed or downloaded into a school file share by Doorpost. Sharing ends automatically on the retention schedule.
Encryption
Everything travels over TLS. Family documents are encrypted at rest (XSalsa20-Poly1305) with a key kept outside the database and outside the web root. Passwords are hashed with bcrypt. Sign-in links and API keys are stored only as SHA-256 digests.
Access
Roles are fixed: platform, administrator, staff (by area), teacher, parent. Staff see only their school. Every document view, share, and revocation is written to an access log the family can read. Administrative changes are audited.
Accounts
Nobody self-registers. Schools invite staff; families are invited when a student enrolls. Sign-in attempts are rate-limited. Sessions are HTTP-only, secure cookies. Forms carry anti-forgery tokens.
Browser hardening
A strict Content Security Policy, no third-party scripts, no iframes, HSTS, and no inline JavaScript.
Backups
Nightly encrypted database backups and weekly full archives to off-site object storage, with restore drills.
Reporting a problem
Email security@doorpost.org. We answer within one business day and will not pursue good-faith researchers.