- Our approach
The Platform is built to hold no more than it needs, restrict who can see what by role, and lean on established infrastructure (Google, Cloudflare) rather than home-grown storage for anything sensitive:- Encrypted in transit — every page and request runs over HTTPS, including registration forms, parent-consent links, and the admin dashboard.
- Passwords never stored in plain text — school account passwords are hashed with bcrypt before they touch storage; OSSDF staff can’t look one up even if asked to.
- Google Sign-In for staff roles — judges, tabulators, and admins authenticate with their own Google account; we never see or store a password for these roles at all.
- Role-scoped access — a teacher’s login can only reach their own school’s data; account admin, event admin, judge, and tabulator are four separate privileges, each granted individually.
- Accounts & access
A school’s registering teacher receives a generated School ID and a randomly-generated password, sent once at approval. Rate-limiting slows repeated failed login attempts against a school account. If a password is ever lost or suspected compromised, an OSSDF Account Admin can issue a fresh one — the old one stops working immediately. - Data in transit & sessions
Login sessions are held in a cookie that your browser can’t read via script, is only ever sent over HTTPS, and expires automatically after 24 hours — so a shared or public computer doesn’t stay signed in indefinitely. - Uploaded files
Music files submitted for a dance entry are stored in private cloud storage (Cloudflare R2), reachable only via a time-limited link generated for playback during judging — files aren’t publicly listable or guessable by URL. - Payments
The Platform never asks for or stores a credit card, debit card, or bank account number — it simply isn’t built to. Registration and entry fees are arranged directly between your school and OSSDF’s treasurer, by invoice, e-transfer, or cheque. There’s no card data on the Platform to protect, because there’s none collected. - Reporting a concern
If you believe you’ve found a security issue with the Platform — anything from a data-access concern to a technical vulnerability — please email us directly rather than posting it publicly, so we can look into it before it’s widely known at: ossdancefest@gmail.com
