Legal
Security
Last updated: June 1, 2026
We take the security of your account and data seriously. Below is an overview of the safeguards built into the platform.
Password protection
Passwords are never stored in plain text. We hash them with a strong, salted algorithm and enforce minimum strength requirements at sign-up.
Secure sessions
Sessions use signed, HTTP-only cookies. We apply CSRF protection on state-changing requests and rate limits on sensitive actions like login and messaging.
Safe by design
PeerTutor is free for everyone, so there's no checkout, no card data, and no payment information to protect. That removes an entire class of risk for students and tutors alike.
Tutor review
New tutor profiles are reviewed before going live, and many tutors complete a background check shown as a badge on their profile.
Data handling
All input is validated on the server, and access to every resource is authorized — you can only read and act on data you own or are a participant in. We use parameterized database queries throughout to guard against injection, and we escape user-generated content to prevent cross-site scripting.
Your part
Security is shared. Use a strong, unique password, keep it private, and sign out on shared devices. Never share login codes, and be cautious of anyone asking you to move a conversation off the platform or to pay for tutoring — PeerTutor is always free.
Reporting a vulnerability
If you believe you’ve found a security issue, we’d like to hear from you. Send details and steps to reproduce through the contact page, and give us a reasonable chance to respond before any public disclosure.