M³ EduCore Security and Data Practices

Account and access protections

The application supports verified accounts, role-based authorization, stronger controls for privileged access, two-factor authentication workflows, session management, and security audit visibility for designated administrators.

No control eliminates all risk. Users should use unique passwords, enable two-factor protection where available, protect devices, and promptly remove access that is no longer needed.

Assessment and scan data

The free-plan product description states that scan images are retained for 24 hours and then deleted. Derived responses, scores, and required records may follow different retention rules according to the service configuration and institutional agreement.

Institutions should avoid collecting unnecessary personal data, define lawful purposes and retention periods, and verify their deployment terms before using the service for sensitive or high-stakes assessment.

Report a concern

Send security concerns to mharfemicaroz@gmail.com with a clear description, affected URL, reproduction steps, and potential impact. Do not publicly disclose student data, credentials, access tokens, or exploitable details.

This page describes product practices and does not claim a third-party certification, regulatory approval, penetration-test result, or absolute security guarantee.

Frequently asked questions

Does M³ EduCore support two-factor authentication?

Yes. The application includes two-factor setup and challenge workflows, with additional controls for privileged access.

How long are scan images retained?

The published free-plan description states 24-hour scan-image retention followed by deletion. Institutions should confirm the applicable terms for their selected plan and deployment.

Is M³ EduCore certified to a security standard?

No third-party security certification is claimed on this page. Any future certification should be independently verifiable before being advertised.