Tenant isolation
Every record belongs to one institution. The server determines your institution from your login, never from the browser, and every query is limited to it. Two institutions cannot see each other’s students, leads, fees or classes.
Security you can check, not just read.
What AcaMint does today — and what it does not claim.
Role-based access
Permissions are checked on the server. Faculty see only their batches; counsellors don’t see fees; students see only their own data.
Authentication
Passwords are stored only as salted PBKDF2-SHA256 hashes, and common passwords are refused. Repeated failed logins are rate-limited. Sessions use random tokens stored as hashes, in secure, HttpOnly cookies. New accounts must choose their own password at first login.
Request protection
Pages send strict security headers (including a content security policy), cookies are same-site, and the server rejects requests that originate from other websites.
Your data, your copy
Owners can download their students, leads, payments, attendance, courses, batches and classes as spreadsheet (CSV) files at any time.
Secrets
Keys and setup secrets live in Cloudflare’s encrypted settings, never in the browser or in the code.
Audit logging
Important actions — creating students, recording fees, publishing classes, resets and “View as Student” — are recorded with who and when.
Support access is your choice
AcaMint staff can open a view of your workspace only if you switch support access on (for 24 hours, 3 days or 7 days). It is read-only with downloads off, needs a stated reason, shows a banner, notifies you, is logged, and ends by itself or when you turn it off.
View as Student is visible
When an owner views the portal as a student, a banner is shown, the view is read-only and both start and end are logged.
Input checks
Emails, dates, amounts, links and IDs are validated on the server, not only in the form.
Hosting
AcaMint runs on Cloudflare’s global platform, and data is stored in Cloudflare’s database service.
What we do not claim
AcaMint does not currently hold third-party security certifications, and we do not use labels such as “bank-level security”. Google Drive links are protected by your Google sharing settings, not by AcaMint — AcaMint decides who is shown a class, Google decides who can open the file.
Still being built: two-factor sign-in. We will list it here when it is live.
Questions about security?
Start with a free workspace or explore the live demo — no sign-up needed.
Start Free Book a Demo