NEDSecurity Overview
Last updated: 11 July 2026
NED is a small, focused training app that stores account records, trial, subscription and office details, receipt references, and team attendance registers. The controls below describe how those records are protected.
Account security
- Managers sign in with Google OAuth or one-time magic links. NED does not use or store passwords.
- Browser sessions use opaque server-side session tokens stored in secure, HTTP-only, SameSite cookies.
- Sign-in links expire quickly, are single use, and are rate-limited by IP address and email address.
- Admin access is restricted to a server-side email allowlist stored outside the public codebase.
User and attendance records
- Attendance registers are available only to the manager who ran the session, except for authorised NED administrators.
- Live-session join and voting links include a per-session key. Voting and attendance APIs validate the key, joined participant and current question server-side.
- Runtime session/vote data is designed to live outside the public web root, and any legacy web-root data directory is blocked from direct browser access.
- Account, receipt and register APIs send no-store cache headers to reduce the chance of sensitive data being cached by browsers or intermediaries.
Payment records
- Payments are handled by Stripe Checkout on Stripe-hosted pages. NED does not collect, process or store full card numbers or CVVs.
- NED stores only operational payment records: Stripe session/receipt reference, module id, amount, currency, customer email, payment status and timestamp.
- Stripe webhooks are verified with the Stripe signing secret before a subscription or payment is recorded.
- Checkout creation and webhook handling are idempotent, so retries and double-clicks should not create duplicate subscription or receipt rows.
Application hardening
| Control | How NED applies it |
|---|---|
| HTTPS | Production uses HTTPS with HSTS. |
| Server-side authorisation | Subscriptions, account records, receipts, attendance exports and admin actions are checked by the PHP API, not by local browser state. |
| Secrets management | Database, Stripe, Google OAuth, SMTP and admin secrets are stored server-side and are not committed to the public web files. |
| CSRF protection | State-changing authenticated endpoints require same-origin requests and use SameSite cookies. |
| Browser security headers | NED sends content-type, frame, referrer, permissions and Content Security Policy headers appropriate to each page surface. |
| Abuse controls | Sign-in, live market and attendance endpoints use lightweight rate limiting. |
| Monitoring | A health endpoint checks key runtime dependencies without exposing secret values. |
Incident handling
If we identify a privacy or security incident, we assess the impact, contain the issue, preserve relevant logs, and notify affected people and regulators where required. Under New Zealand's Privacy Act 2020, notifiable privacy breaches are assessed against the serious-harm threshold.
Accreditation status
NED does not currently claim SOC 2, ISO 27001, PCI certification, Privacy Trust Mark, or any government security accreditation. Payment-card handling is intentionally outsourced to Stripe Checkout to keep NED's card-data footprint low. Security and compliance claims will be updated only after the relevant external assessment or validation has been completed.
Report a concern
To report a suspected security or privacy issue, email [email protected]. Please do not include passwords, card details, or other unnecessary sensitive information in your report.