How MarkWise keeps attendance data safe

MarkWise runs on Google Cloud, with our API hosted on Cloud Run behind HTTPS/TLS end to end — every request between your device and our servers is encrypted in transit. Our database is not publicly reachable; it's only accessible from our own backend services.

Passwords are never stored in plain text — they're hashed with a salted algorithm before they ever touch our database, so we can't read your password and neither could anyone who gained access to it. Sessions use cryptographically signed tokens that expire and are verified on every request.

Where MarkWise offers passkey/biometric sign-in on mobile, that verification (fingerprint or face) happens entirely on your own device via the platform's WebAuthn implementation — your biometric data itself is never sent to, or stored by, MarkWise.

MarkWise's in-person attendance methods (Bluetooth proximity, QR code, and PIN check-in) are built around one threat in particular: one student checking in on behalf of another. Sessions and check-ins are cryptographically signed and time-boxed, and our backend runs shared-device and location-plausibility checks to flag attendance marked from a device or place already tied to a different student in the same window. Cached PINs used for offline check-in are stored encrypted on-device and expire with the session they belong to.

Every institution's data — students, lecturers, units, and attendance records — is logically isolated from every other institution's. Access is scoped by institution and role on every request, so an account at one school can never see or affect another school's data.

Accounts can be deleted directly in the app, from within account settings. Deleting your account removes your personal profile data; see our Privacy Policy for the full detail on what's retained and why (institutions, for example, retain aggregate attendance records for academic purposes).

If you believe you've found a security issue in MarkWise, please tell us before disclosing it publicly — reach out through our Contact page with as much detail as you can share. We take every report seriously and will work with you to confirm, fix, and acknowledge it.