No User Accounts Required
Essay Grader AI uses a passwordless, API key-based authentication model. There are no user accounts, no passwords, and no login portals. This eliminates entire classes of security vulnerabilities including credential stuffing, password breaches, and phishing attacks.
How Authentication Works
- When you purchase credits, we generate a unique Site Identifier and API Key, sent automatically to your email
- Your Moodle™ plugin uses these credentials to access AI grading services
- API keys are cryptographically secure (256-bit entropy) and can be rotated anytime
- Each Moodle™ site has isolated credentials - credentials cannot be reused across sites
Simple One-Time Payments
Essay Grader AI uses a pay-as-you-go credit system with one-time payments. There are no subscriptions, no recurring charges, and no automatic billing.
How Payments Work
- Purchase credits when you need them - bundles of 100, 500, or 1000 credits at 10¢ per credit
- All payments processed through Stripe Checkout - we never see your payment details
- Credits never expire - use them at your own pace
- No stored payment methods - each purchase requires new payment authorisation
- Receive instant email confirmation with transaction ID and updated credit balance
This model ensures you're always in control - no surprise charges, no auto-renewals, and complete payment transparency.
End-to-End Encryption
All data transmitted between your Moodle™ site and Essay Grader AI (AI Essay Grader, AI Essay Maker, and AI Content Creator) uses TLS 1.3 encryption with modern cipher suites. Data at rest is encrypted using AES-256-GCM encryption with rotating keys.
Cryptographically Secure API Keys
API keys are generated using cryptographically secure random number generation (CSPRNG) with 256 bits of entropy. Each key is prefixed with 'aigr_' and consists of 64 hexadecimal characters.
Enterprise Database Security
PostgreSQL databases with mandatory SSL/TLS connections, row-level security policies, and automated encrypted backups every 6 hours. Point-in-time recovery available for 30 days.
Infrastructure Hardening
Cloud infrastructure with DDoS protection, WAF (Web Application Firewall), automated security patches, intrusion detection systems, and 24/7 monitoring with alerting.
PCI DSS Level 1 Payments
All payment processing handled by Stripe, a PCI DSS Level 1 certified provider. We never see, store, or process credit card data. Stripe handles tokenisation and secure card vaulting.
Zero-Retention Privacy
Student submissions are processed in real-time for AI feedback and immediately discarded. Essay question generation and slideshow content requests are also processed without storage. No student content is logged or stored. We maintain minimal metadata for billing purposes only.
Compliance & Standards
Meeting Australian regulatory requirements and international best practices
Australian Privacy Act 1988
Full compliance with Australian Privacy Principles (APPs) including consent, purpose limitation, data quality, security, and transparency requirements. Our Privacy Policy details all collection and use practices.
Data Sovereignty
Primary data storage in Australian AWS data centres (Sydney region: ap-southeast-2). OpenAI processing occurs in US data centres with appropriate cross-border safeguards. All data transfers comply with Australian privacy law requirements.
Educational Data Protection
Zero-retention policy for student submissions. Only aggregated, anonymised usage statistics are retained for service improvement. Student personally identifiable information (PII) is never stored or shared with third parties.
PCI DSS Compliance
Stripe handles all payment card data as a PCI DSS Level 1 Service Provider. Our systems are scoped out of PCI requirements as we never touch cardholder data. Stripe uses tokenisation to secure all payment methods.
Our Security Practices
Proactive security measures and continuous improvement
Continuous Security Monitoring
Real-time monitoring with automated alerts for suspicious activity, failed authentication attempts, unusual API usage patterns, and infrastructure anomalies. Incident response team available 24/7.
Automated Encrypted Backups
Database snapshots every 6 hours with AES-256 encryption. Backups replicated across multiple availability zones. 30-day retention with point-in-time recovery. Regular restoration testing performed monthly.
Zero-Trust Access Controls
Multi-factor authentication (MFA) required for all team access. Role-based access control (RBAC) with principle of least privilege. All administrative actions logged with immutable audit trails.
Incident Response & Disclosure
Documented incident response plan with defined escalation procedures. In event of data breach affecting Australian residents, notification within 72 hours as required by Privacy Act. Transparent communication through status page.
Dependency & Vulnerability Management
Automated dependency scanning with immediate alerts for critical vulnerabilities. Regular penetration testing by third-party security firms. Security patches applied within 48 hours of availability.
Secure Development Lifecycle
Code reviews required for all changes. Automated security scanning in CI/CD pipeline. Regular security training for development team. Secure coding standards enforced through linting and static analysis.
Security Best Practices
Help us keep your credits and data secure
- Protect Your API Key
Store your API key encrypted in your Moodle™ configuration (use Moodle™'s config encryption features). Never share it publicly, commit it to version control, or send it via unencrypted email. Treat it like a password - it provides direct access to your credits.
- Monitor Credit Usage
Regularly check your credit balance and transaction history. Unexpected consumption patterns may indicate unauthorised API access. We provide usage logs accessible via API for automated monitoring.
- Use HTTPS Only
Ensure your Moodle™ site uses HTTPS with a valid SSL/TLS certificate. This protects API keys and student data in transit. We reject connections from non-HTTPS sources in production.
- Report Security Concerns Immediately
If you notice suspicious activity, unusual credit consumption, or potential security issues, contact us immediately at security@lmshostingservices.com. We investigate all reports within 24 hours.
- Keep Systems Updated
Maintain your Moodle™ installation and AI Essay Grader plugin with latest security patches. We notify all clients of critical updates via email. Enable auto-updates where possible.
- Rotate API Keys Regularly
As a security best practice, rotate your API keys every 90 days or immediately if compromised. Contact support to generate new keys - your credit balance transfers automatically.
Responsible Disclosure Policy
We welcome reports from security researchers who discover vulnerabilities. If you find a security issue, please report it responsibly:
- Email details to security@lmshostingservices.com
- Provide steps to reproduce and potential impact assessment
- We commit to acknowledging within 48 hours and fixing within 7 days for critical issues
- Public disclosure coordinated after patch deployment (typically 30 days)
Security Questions?
Our security team is here to help with any questions or concerns.
General Security: security@lmshostingservices.com
Support: support@lmshostingservices.com
Last updated: November 2025 • We review and update our security practices quarterly