1.Our approach
The safest data is data we never hold. Your study progress lives in your own browser, we do not ask for passwords, and card details go straight to our payment provider. That keeps the amount we could ever lose small.
2.What is in place today
Controls that exist now:
- The site is served over HTTPS by our hosting provider.
- Payment orders are created on the server, amounts come from our own price list and never from the browser, and payment signatures are verified on the server before a receipt is issued.
- Forms that send mail or applications are rate limited and validated on the server.
- No card, bank or identity numbers are stored by NextPrep.
- Third-party scripts are kept to a minimum, and analytics stay off until you allow them.
3.What is not in place yet
We want to be plain about the gaps. NextPrep has no accounts or server-side storage of study data yet, so entitlements are enforced in the browser and are a product boundary, not a security one. We have not had an independent penetration test or a formal security audit. When accounts arrive, the security model will be rewritten and published here before launch.
4.Report a vulnerability
If you believe you have found a security problem, please tell us through the contact page and choose the topic "A security concern". Say what you found and how to reproduce it. Please do not access other people's data, disrupt the service or publish details before we have had a reasonable chance to fix it. We will acknowledge good-faith reports and will not pursue people who follow these rules. We do not run a paid bounty programme.
5.What you can do
Keep your browser up to date, be careful on shared computers (use Settings, then Delete my profile and data, when you finish), and treat any message asking for payment outside the NextPrep checkout as suspicious. We will never ask for your card number by message.