1. Layered security
ClassControl uses multiple security layers across the website, APIs, mobile applications, database access and administrative tooling.
2. Encryption
- HTTPS/TLS protects web and API communication.
- PAR-Q fields are encrypted before database storage using AES-256-GCM authenticated encryption.
- Encryption keys are stored separately from the public web root.
- Passwords are stored using one-way password hashing.
3. Identity and access
- Separate member, instructor, administrator and Super Administrator roles.
- Company-scoped access controls.
- Multi-factor authentication for Super Administrators.
- Hashed trusted-device validators with 30-day expiry.
- Secure session and API authentication controls.
4. Mobile and QR attendance
iOS and Android applications communicate with the ClassControl API over HTTPS. QR attendance validates the scanning user’s role, company access, class access, member identity and active booking before recording attendance.
5. Operations
Access to hosting, database and production configuration is restricted. Security fixes and dependency updates are applied as part of ongoing maintenance. Sensitive secrets must not be committed to source control.
6. Shared responsibility
Customers must manage user permissions, protect credentials, remove access promptly when personnel leave and determine lawful processing and retention rules for their data.
Document status:
This document is provided as an operational draft for ClassControl.
Commercial terms, supplier arrangements and legal obligations should
be reviewed by a qualified UK solicitor before contractual reliance.