Security

All traffic between your browser or mobile app and EverLearn's servers is encrypted in transit (HTTPS/TLS). Passwords are never stored in plain text — they're hashed using bcrypt before being saved.

Every school's students, staff, results, and fee records are scoped strictly to that school in our database. Teachers, parents, and students can only ever access data tied to their own school and, for parents and students, their own linked records.

Access is governed by role (School Admin, Teacher, Parent, Student) at every layer — the API rejects any request for data a role isn't entitled to see, not just the interface.

Production data is backed up regularly so a school's records can be restored in the event of data loss.

Subscription payments are processed by CitaPay over M-Pesa — EverLearn never stores your card or mobile money PIN.

If you discover a security vulnerability, please email support@everlearn.co.ke rather than disclosing it publicly. We take all reports seriously and will respond promptly.