Security
Security at Method Math
Effective date: June 30, 2026. This page summarizes security practices for the Method Math website and family portal. It is not a guarantee that any system is completely secure.
Account protection
- Family and admin logins use Supabase Auth.
- New passwords must be at least 12 characters.
- The portal uses limited-duration Supabase sessions and checks account permissions before loading protected data.
- Admin users should use individually assigned accounts, strong passwords, and MFA where supported by the identity provider.
Data protection
- Supabase database policies check authenticated users and roles before returning family, student, or appointment data.
- Parents can only access student records connected to their own family account.
- Admins can manage families, students, availability, and appointments.
- Booking event logs store references to appointments rather than duplicating full student and family details.
Operational safeguards
- Security headers are configured for the site, including frame protection, content-type protection, referrer policy, permissions policy, and content security policy.
- Server secrets should be stored only in Cloudflare or Supabase server environments, never in source code or public JavaScript.
- Method Math should periodically review access, dependencies, backups, and privacy requests.
To report a security concern, email [email protected]. Do not send passwords, tokens, or student records by email unless requested through a secure process.