Security

Important access controls are enforced at the database level, with additional authorization checks in trusted application paths.

Each role, whether student, moderator, campus responder or administrator, can do only what that role needs, and the most sensitive actions are recorded when they happen.

• You sign up with your school email address and confirm it through a link sent to that address before the account can be used.
• Passwords are handled by our authentication provider and stored only as one-way hashes, never in readable form.
• Signing in, signing up and resetting a password include an automated check that separates people from bots.
• Moderators and administrators are granted their roles individually. Campus offices that respond on the record can post updates; they cannot edit or remove what students post.

Every report a student files appears as “A verified student”. This is enforced by the database, not left to a setting, and it applies to the replies a student posts on their own report too.

Moderators can see who filed a report only through a restricted function, when they need to in order to enforce the rules. Revealing a reporter's identity is limited to administrators and requires a stated reason. That access is recorded in an audit log, including who accessed the information and the reason provided.

Text a student writes, and the names of files they attach, are theirs; Civcampus does not rewrite them. If you do not want to be identifiable, leave identifying details out of what you post.

• Photos and documents attached to a report are reviewed separately from the report. Approving a report does not publish its attachments.
• Until an attachment is approved, only the student who attached it, moderators and administrators can open it, and when staff open unpublished material, that access is recorded.
• Attachments open through links that expire, within an hour, so a copied link does not keep working.

Service providers may include Supabase, Vercel, Cloudflare, and others described in our Privacy Policy. Credentials with administrative access to the database are used only on our servers and are never sent to your browser.

If you believe you have found a security problem, email team@jyvo.appwith what you found, how to reproduce it, and how to reach you. Please do not access, change or keep anyone else's information, and do not run tests that could slow the site down for students. We will reply as soon as we can.

This page is a high-level overview. We do not publish internal details that would make Civcampus easier to attack, such as how administrative access works, the limits our abuse protections use, or how our systems are put together internally. Leaving those out is deliberate, not a sign that the work is missing.

• No online service can be made perfectly secure, and Civcampus does not claim to be.
• Civcampus is not an emergency service and is not monitored around the clock. If you or someone else is in danger, see Safety resources.