Security

Schools trust Brigaly with children's information, so safety is built into how it works, not added on. This page explains the main protections.

1. Verified institutes

Anyone can list an institute, but the verified badge appears only after we confirm it is run by the people who say so, using one of:

• a code sent to an official email address on the institute's own domain;
• a registration or affiliation document, reviewed by our team;
• a phone call to the institute's listed number.

Until it is verified, an institute has a member limit. If someone claims an institute they do not represent, write to help@brigaly.com and we will investigate.

2. Roster-matched joining

Students, parents and staff join with the institute's own link or QR code. Where the institute has uploaded its roster, people are matched to their record by phone or email. Anyone who does not match waits for an admin to approve them. A parent is linked only to their own child.

3. No open chat

There are no direct messages between members. Families talk to the school, and teachers talk to their classes, in groups the institute controls — so a stranger cannot message a child.

4. Access and roles

Each person sees only what their role allows. Admin roles can be limited to particular grades or departments, and the institute's owner decides who is an admin.

5. Audit log

Every publish, approval, removal and change of role on a campus is recorded with who did it and when. Admins can review the log at any time.

6. Account security

• Sign-in uses one-time codes, Google, or a password you choose; codes expire after 10 minutes and are limited in how often they can be sent.
• You can turn on two-step verification in Settings › Account.
• Closing an account signs it out of every device at once.

7. Protecting data

All traffic to Brigaly is encrypted with HTTPS. Data is stored with established cloud providers (see the Privacy Policy), access by our team is limited to what is needed to run and support the service, and passwords are stored only as secure hashes.

8. Report a problem

If you find a security vulnerability, please write to help@brigaly.com with the details and steps to reproduce it, and give us reasonable time to fix it before telling anyone else. Please do not access other people's data or disrupt the service while testing. For a safety concern about content or a person, write to help@brigaly.com or use the grievance process.