عJoin free

Trust and security

How Tiswa protects student data, the public grades anyone can check, who hosts what, and how to report a security problem.

Last updated: 4 November 2026

Public security grades

These come from free, independent scanners. You can run them yourself with the links.

How we protect your data

  • Encrypted connections everywhere. Only TLS 1.2 and 1.3. Browsers are told to use HTTPS for two years (HSTS preload). The database refuses connections without SSL.
  • Encrypted storage. The database, files and backups are encrypted at rest by our hosting providers.
  • Access rules on every table. The app can only read and change what belongs to the signed-in student. Staff see only what their role needs.
  • Your student card stays on your phone. The ID scan runs on your iPhone and only the yes or no results reach us. If staff ask for a document, it is deleted 30 days after you send it.
  • One phone per account. Accounts are tied to one device with Apple App Attest, so a stolen code or password is not enough to take over an account.
  • Data is deleted on time. Deletion jobs run every night by the periods in our privacy notice. Deleting your account erases it within 30 days, backups included.
  • Watched around the clock. Firewalls at Cloudflare and Vercel block attacks, and error monitoring tells us when something breaks.

Saudi data protection law

Tiswa follows Saudi Arabia’s Personal Data Protection Law (PDPL), overseen by the Saudi Data and AI Authority (SDAIA). We keep a record of every kind of personal data we process, have assessed the privacy risks of student checks, location, the For You feed and hosting outside the Kingdom, and have a written plan to tell SDAIA within 72 hours if a breach could harm anyone. Your rights and how to use them are in the privacy notice.

Who hosts what

Tiswa does not hold a SOC 2 or ISO 27001 certificate of its own. The providers that host Tiswa’s data do:

  • Supabase (database, sign-in, files; Mumbai, India): SOC 2 Type 2.
  • Vercel (business and staff consoles; Mumbai, India): SOC 2 Type 2 and ISO 27001.
  • Cloudflare (network security and DNS): SOC 2 Type II, ISO 27001 and ISO 27701.
  • Sentry (crash reports; Germany): SOC 2 Type II and ISO 27001.
  • Resend (email delivery; United States): SOC 2 Type II.

The full list of providers, with what each one does, is in the privacy notice under “Who processes data for us”.

Report a security problem

If you find a weakness in the Tiswa app, tiswa.app or our consoles, email partners@tiswa.app with “Security report” in the subject. We reply within 3 working days and keep you posted until it is fixed. Our contact details for researchers are also in security.txt.

Please test only with your own account, do not access or change other people’s data, do not run attacks that slow the service down, and give us a fair chance to fix the problem before you talk about it publicly. We will not take legal action against anyone who reports in good faith within these limits.

For universities and partners

Universities and businesses can ask for our record of processing, privacy impact assessment, list of providers, information security policy and our self-assessment against the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC). Write to partners@tiswa.app.