Security Architecture

1. Authentication & Session Encryption

Addu employs state-of-the-art token validation mechanisms. All portal requests use secure JSON Web Tokens (JWT) signed with environment keys. Authentication routes utilize security headers and strict password encryption via `bcryptjs` (using a Work Factor of 10) to guard against brute-force attacks.

2. Two-Factor Authentication (2FA) & IP Whitelists

Admins and teachers can activate extra layers of access control directly from their dashboards:

• 2FA (TOTP): Generates cryptographic secrets for synchronization with Google Authenticator or Microsoft Authenticator.
• IP Whitelisting: Locks connection access so that credentials can only connect from designated school campus static IP addresses.

3. Storage & Backups

All document uploads (like study materials and syllabus sheets) are scanned and stored securely in private AWS S3 buckets. School database backups run automatically at midnight via a cron system that saves backups with AES-256 encryption.

4. Connection Protection

Platform traffic is protected by custom rate limiters (`express-rate-limit`) to prevent DDoS and automated scrapers. Furthermore, we run real-time CORS checks dynamically matching registered subdomain certificates to isolate database records.