Security

How we protect centres' information in Centrely, and how to tell us about a security problem. What's here is built and in final testing, unless it's marked "Coming later".

Signing in

• Getting into a centre's information takes a password and a code from an authenticator app, for everyone.
• Setting up an account, and recovering one when a phone is lost, go through a few limited steps first, each with its own checks.

Who sees what

• Each person gets only the parts their centre's owner gives them, at the branches they're assigned to.
• Only owners can change the bank details parents pay into, and they enter their authenticator code again to do it.

Each centre kept apart

Each centre's information is kept apart from every other centre's by the database's own rules, not only by the app's screens. We test these controls, but no control can promise nothing ever goes wrong.

A record of changes

Centrely records who changed what, and when, so a centre can always see how its information came to be.

Keys and this website

• The secret keys to the services that run Centrely stay on our servers.
• This website has no sign-in and no forms. It sets no cookies, has no trackers, loads nothing from other sites, and is offered only over encrypted connections (HTTPS).

Coming later Coming later

• Centrely's data stored in Singapore, as our privacy policy says.
• The access a centre gives Centrely to its WhatsApp account kept encrypted.
• Error reports with phone numbers and message text removed before they leave Centrely.

Report a security problem

Email support@getcentrely.com with "Security" in the subject. Tell us what you found and how to see it. While you look, please don't access other people's information, change anything, or disrupt Centrely, and give us time to fix it before you tell anyone else. We'll reply to say we have it, and tell you when it's fixed.