Security built into every layer

Every organization on Aula is a separate tenant. Isolation between tenants is enforced in PostgreSQL using row-level security, so data access is restricted at the database itself — not only in application code.

• Email and password sign-in
• Sign in with Google, GitHub or Microsoft
• Single sign-on via SAML or OIDC for your identity provider
• Two-factor authentication for an extra layer of protection
• Role-based permissions for owners, admins, teachers, students and parents, so people only see what their role allows

Administrative actions within an academy are recorded in audit logs, so admins can review who changed what.

At the platform level, actions by our own super-admins are recorded in a separate audit trail, including logging whenever an account is impersonated for support purposes.

• Rate limiting on public endpoints to reduce abuse
• API keys to control access to the REST API
• Webhooks to notify your systems of events

• Encryption in transit: all traffic is served over HTTPS/TLS
• Files are stored on Cloudflare R2 and video is delivered through Bunny Stream, both with access-controlled URLs
• Payments are processed by Stripe — card data never touches our servers

We carry out regular internal security reviews of the platform and treat security as part of everyday engineering, from code review to deployment.

If you believe you have found a security vulnerability in Aula, please report it to security@example.com. Include enough detail for us to reproduce the issue, and give us reasonable time to investigate and fix it before sharing it publicly. We appreciate the work of researchers who help keep our users safe.