Your Grades Are Not
Behind a Password.
They Are Behind a Proof.
GENIE was built with a single assumption about the threat environment: every admin portal is a target, every predictable URL is a vulnerability, and every unverified grade record is a liability. Our security architecture was designed accordingly — not as a feature, but as the foundation.
threat_register — known attack vectors
We Designed For
Every Adversary.
Academic software has historically been built for usability in trusted environments. The assumption was that the threat was low. That assumption has been systematically disproven. Grade manipulation, credential stuffing, transcript forgery, and insider data exfiltration are documented, active threats in tertiary institutions across Africa and the Global South.
GENIE does not extend trust to any environment. Our security model treats every network as hostile, every access request as unverified until cryptographically proven otherwise, and every data record as a target worth protecting with mathematical certainty — not just organisational policy.
genie.security — active threat register
| Threat | GENIE Countermeasure | Status |
|---|---|---|
Grade Record Tampering Direct DB write / API abuse | HMAC-SHA256 grade sealing at submission | neutralised |
Credential Stuffing Known password lists + automation | Adaptive rate limiting + device-bound JWT | neutralised |
Transcript Forgery Doctored PDF / offline manipulation | SHA-256 content hash in public verification ledger | neutralised |
Insider Data Exfiltration Privileged staff direct DB access | Field-level encryption; engineers cannot read grades | neutralised |
JWT Token Replay Intercepted access token reuse | Short-lived tokens (15 min) + rotating refresh tokens | neutralised |
Zero-Day Exploit Monitoring Novel dependency vulnerabilities | Automated dependency and code scanning (Dependabot, CodeQL) in CI | monitored |
grade_seal.verify() + transcript.hash_check()
A Grade Is Not a Number in a Cell.
It Is a Cryptographic Commitment.
Once a Lecturer submits grades through GENIE, the record cannot be silently altered. Every modification — legitimate or otherwise — is mathematically detected and attributed.
Grade Sealing
HMAC-SHA256 · Per-record signing · Tamper-evident
Input components
Lecturer device key + course ID + student matric + score + submission timestamp
Algorithm
HMAC-SHA256 over concatenated components
Output
A 64-character hex digest stored alongside the grade record
Verification
System recomputes digest on every grade read. Mismatch triggers immutable GRADE_TAMPER audit event
Post-submission changes
Permitted only via authorised Dispute Resolution workflow — each change generates a new signed record; old record is preserved, not overwritten
# example grade record (sealed)
student: CSC/2023/0089
course: STAT302
ca_score: 52
exam_score: 61
seal: a3f8e1c9d2b74056e1f3...
status: VERIFIED ✓
Transcript Integrity Hash
SHA-256 · Public verification · Forgery-proof
Hash input
Entire transcript content (all courses, all scores, student identity fields, institution ID, generation timestamp)
Algorithm
SHA-256 over canonicalised JSON representation of transcript data
Hash storage
Stored separately from the transcript PDF — in a tamper-evident log not writable by the application layer
Third-party verification
Employers and institutions can verify authenticity at verify.genie.ng by submitting the transcript's reference code — no GENIE account required
Forgery detection
A single character change in a doctored transcript breaks the SHA-256 hash. The verification endpoint returns INVALID immediately
# public verification — no login required
GET verify.genie.ng/TXN-2024-MAPOLY-0089
→ 200 OK
transcript: AUTHENTIC ✓
issued: 2024-11-14T09:22:31Z
hash_match: true
institution: MAPOLY · Verified Signatory
Security Stack — Layer by Layer
Seven Layers.
No Single Point of Failure.
Expand each layer to inspect the specific implementation decisions, algorithms, and technical standards in use.
The Insider Threat Model
GENIE Engineers
Cannot Read
Your Students' Grades.
The most dangerous threat to any data system is not external. It is the trusted insider — the engineer with production database access, the support agent with elevated permissions, the contractor with a legacy credential that was never rotated.
GENIE's architecture operates on the principle that internal access must be no more trusted than external. Our engineers do not have persistent production database access. All production access is fully logged and operates against data that is encrypted at the field level with keys the engineering team does not hold.
A GENIE engineer with full production database access sees encrypted ciphertext for every student grade record.
Grade Record Visibility
EncryptedField-level encryption means grade records in the DB are ciphertext blobs. A raw SQL query against the grades table by an engineer with DB access returns encrypted data only.
All Internal Actions Logged
AuditedEvery internal access event — including production access sessions — is written to the same immutable audit log that governs institutional activity. No exception.
Security Posture Metrics
The Numbers Behind the Assurance.
AES-256
Encryption at rest
NIST FIPS 197 standard
TLS 1.3
Encryption in transit
RFC 8446 · PFS enabled
15 min
Access token TTL
Industry minimum standard
NDPA 2023
Regulatory compliance
+ GDPR-aligned principles
Regulatory & Standards Alignment
NDPA 2023
CompliantNigeria Data Protection Act
GDPR Principles
AlignedLawfulness · Minimisation · Purpose Limitation
NIST AES-256
ImplementedFIPS 197 Advanced Encryption Standard
RFC 8446
EnforcedTLS 1.3 Transport Layer Security
OWASP Top 10
AddressedWeb application security risks mitigated
NUC Accreditation
SupportedAudit-ready data exports for NUC/NBTE
security.briefing.available()
Bring Your Security Architect.
We Will Answer Every Question.
Every institution deploying GENIE is entitled to a full technical security briefing — attended by our lead security engineer — before signing any deployment agreement. If our posture does not satisfy your institution's security requirements, we will not deploy.
ops@thegenieos.com · Encrypted communications preferred (PGP key available on request)