Security
Teachers trust us with their students’ work, often children’s. Here is how we protect it.
Last updated 11 November 2026
Your data
- Everything is encrypted in transit (HTTPS/TLS) and at rest (database, files and backups).
- Data is stored in the European Union (Ireland).
- We collect as little as possible: a student only needs a display name.
- Our logs never contain names, email addresses, student work or sign-in tokens.
Accounts and sign-in
- Passwords are hashed with Argon2id, the algorithm recommended by OWASP, with a secret pepper. We never store or log passwords in plain text, and we block common passwords and passwords that contain your email.
- Sign-in sessions use secure, HTTP-only cookies and expire automatically. Changing your password signs out every other device.
- Repeated failed sign-ins are rate limited, and sign-in errors never reveal whether an email has an account.
- Students do not have passwords: they use a class code or a personal link, and a teacher can remove access at any time.
Student files
- Photos, recordings and files are never public. They are only shown through private links that expire after a short time.
- Links that teachers add are fetched by our servers with protection against requests to internal networks.
- Programs and web pages cannot be uploaded as documents.
Infrastructure
- Hosted on Amazon Web Services in Ireland, with least-privilege access and no long-lived access keys in production.
- Automatic backups, encrypted and stored in the EU.
- Payments are handled by Stripe (PCI DSS Level 1); card details never touch our servers.
Reporting a problem
If you think you have found a security issue, please email hi@learnworkly.com with the subject “Security”. We will reply quickly and keep you informed while we fix it. Please do not access other people’s data or disrupt the service while testing.