Security

All traffic between your browser and ScholarGate travels over HTTPS (TLS). The same applies to the connections between the application and its database and to the third-party services we call.

If you use email and password sign-in, your password is stored only as a bcrypt hash; we cannot read it back. Sessions travel in signed, httpOnly cookies that scripts on the page cannot read: a signed JWT for current sign-ins and an HMAC-signed cookie for sessions opened before the sign-in system changed. Signing out invalidates the session cookie.

Authorization is checked on the server for every request; nothing relies on the browser hiding a button. Your library, projects and chat history are tied to your account, and administrative surfaces are restricted to a short, named list of staff accounts.

Card details never reach our servers. Payment processing is handled by our payment provider (iyzico); we keep only a customer reference and a card token reference.

If you believe you have found a vulnerability or a data problem, contact us through the Contact form. We read every report.