Security

The UniDoodle platform runs on Microsoft Azure in the EU. Student data is stored in a managed Azure SQL database, all traffic is encrypted in transit with TLS, and backups are managed by Azure.

• Separate roles for students, teachers and organisation administrators.
• Every request is checked on the server against the signed-in user and their role.
• Student uploads are private to the student and their teacher or organisation.
• Least-privilege credentials for background services.

All card payments are handled by Stripe (PCI-DSS Level 1). Webhook signatures are verified before any subscription state change.

If you believe you have found a security issue, please email support@unidoodle.ie. Please give us a reasonable time to remediate before public disclosure. We aim to acknowledge reports within five working days, keep you updated while we investigate, and will not pursue action against researchers who report in good faith and avoid accessing other people’s data.