Security
Security at Method Math
Effective date: June 30, 2026. This page summarizes security practices for the Method Math website and family portal. It is not a guarantee that any system is completely secure.
Account protection
- Family and admin logins use Netlify Identity.
- New passwords must be at least 12 characters.
- Session cookies are HttpOnly, Secure, SameSite=Lax, and limited in duration.
- Admin users should use individually assigned accounts, strong passwords, and MFA where supported by the identity provider.
Data protection
- Portal APIs check server-side sessions and roles before returning family, student, or appointment data.
- Parents can only access student records connected to their own family account.
- Admins can manage families, students, availability, and appointments.
- Booking event logs store references to appointments rather than duplicating full student and family details.
Operational safeguards
- Security headers are configured for the site, including frame protection, content-type protection, referrer policy, permissions policy, and content security policy.
- Secrets should be stored only in Netlify environment variables, never in source code or public JavaScript.
- Method Math should periodically review access, dependencies, backups, and privacy requests.
To report a security concern, email [email protected]. Do not send passwords, tokens, or student records by email unless requested through a secure process.