Security

• All traffic is served over HTTPS and enforced with HTTP Strict Transport Security.
• A content security policy, framing protection and a restrictive permissions policy are applied to every response.
• The site is fronted by an enterprise content delivery network providing DDoS mitigation and bot filtering.
• The site holds no user accounts, no payment processing and no learner records. Learner data lives in our separately secured Aptem and Canvas platforms.
• Our organisational controls are certified to Cyber Essentials, and we are an Ofsted Good provider.

If you believe you have found a security vulnerability in this website, please tell us before disclosing it publicly. Email info@nationaleducation.college with "Security" in the subject line, describing the issue, the affected URL and the steps to reproduce it. Our machine-readable policy is published at /.well-known/security.txt.

We aim to acknowledge reports within five working days and to keep you updated until the issue is resolved.

• Do not access, modify or delete data that is not your own.
• Do not run automated scanning that degrades the service for other users.
• Do not use social engineering, physical attacks or denial-of-service techniques.
• Give us reasonable time to fix the issue before publishing.

We do not operate a paid bug bounty, but we will credit researchers who report responsibly if they wish.

For how we handle personal data, including enquiry details submitted through this site, see our privacy notice. Suspected personal data breaches are handled under our group incident response process and reported to the Information Commissioner's Office where the threshold is met.