Security
For IT and legal teams: who signs in and how, who sees what, which actions are recorded and which data is taken from a student’s phone.
Short answer
People sign in only through the university’s identity system, SAML SSO or LDAP / Active Directory; DAS stores no passwords. Admins take a second step and hard-to-undo actions need an e-mail code. Users see only their own scope; every write is recorded. Location is read only while joining a roll call. The current installation runs on the university’s own server.
Sign-in
DAS keeps no passwords
Sign-in runs only through the university’s identity system: SAML single sign-on or LDAP / Active Directory. DAS stores no user passwords; accounts come from the SIS import and there is no self-registration.
- 10 failed attempts in 15 minutes lock the account, for up to 24 hours
- Sign-in and code attempts are rate-limited per account and per IP
- The institution can block sign-ins from abroad and over VPN
Administrator verification
Critical actions are confirmed separately
System administrators, student affairs, system observers and mobile administrators enter the admin screens with a second step: the institution’s SSO verification or a 6-digit code sent by e-mail. Actions such as deleting a user, granting administrator rights or lowering a security setting also need a one-time code tied to that single action.
- The action code has 6 digits and is valid for 5 minutes
- E-mail codes are stored on the server only as a hash
- The last active system administrator cannot be deleted or locked
Role and scope
Everyone sees only their own scope
Lecturers see only their own courses, students only their own record. Student affairs and management access is granted per person with a department, faculty or university-wide scope and with read or write rights per module; staff without a defined scope reach no data at all.
- IT gets a read-only “System Observer” role
- Only a system administrator in a two-step session grants roles
- Past terms are read-only; exceptions are time-limited and reasoned
Activity records
Every write is recorded
Every addition, change and deletion is recorded with who made it, in which role, when, from which IP and which record it touched; failed sign-ins are recorded too. Permission changes, added or removed signatures and support sessions opened with “Impersonate” are also kept in ledgers of their own.
- Passwords, verification codes and national ID numbers are masked
- System administrators in a two-step session and observers can view them
- The retention period is set per installation
Device and location
Location is never read in the background
A student signs from one registered phone; device changes are limited per term and the lecturer, student affairs or a system administrator grants an extra change with a written reason. Location is read only while the app is open and the student joins a roll call; the DAS mobile app has no background location permission, and the institution sets the location check to off, advisory or required.
- Biometrics are only an optional app lock and never leave the phone
- When location is switched off for a roll call, no coordinates are kept
- If a period is set, raw coordinates on class signatures are deleted after it
Lecturers see only their own courses, students only their own record, and student affairs only their assigned scope; system administrators manage the whole system and system observers view it read-only. A signature’s location and device details are visible to that course’s lecturer, and national ID numbers are masked in the lecturer’s signature list.
