LAST UPDATED: September 10, 2026 • JURISDICTION: INDIA

Platform Security & Encryption Architecture

Security Disclosure: Consisto enforces defense-in-depth security architecture across data storage, network transmission, session management, and anti-bot protection.

1. Data Encryption at Rest

Sensitive user fields (such as full names, email addresses, and specific profile data) are symmetrically encrypted before storage in MySQL database tables using **AES-256-GCM** cryptography (`app_encrypt` / `app_decrypt`):

  • Ciphertext Encoding: Formatted as `cipher:iv:tag` using cryptographically secure random 12-byte Initialization Vectors (IVs) and authentication tags.
  • Key Derivation: Encryption keys are derived using SHA-256 HKDF from server-side environment master secret keys (`APP_KEY`).
  • Blind Indexing: To enable zero-plaintext database searches without compromising encryption, lookups utilize blind HMAC-SHA256 indexes (`email_bidx`) computed from `APP_BLIND_INDEX_KEY`.

2. End-to-End Encryption (E2EE) & Zero-Knowledge Warning

Specific sensitive student features—such as private study journals and private Kanban boards—utilize client-side **End-to-End Encryption (E2EE)**:

  • Content is encrypted on your client device prior to transmission.
  • Encryption keys are derived from your account passphrase and are never transmitted to or stored on Consisto servers.
  • CRITICAL NOTICE: Consisto possesses zero access to your E2EE decryption keys. If you lose your account password, E2EE journal entries and private canvas boards cannot be decrypted by our engineering team and will be permanently unrecoverable.

3. Session Security & Token Hashing

Consisto employs strict database-backed session token management (`user_sessions`):

  • Session tokens stored in client cookies are matched on the server against `token_hash = sha256(token)`. Raw tokens are never stored in database tables.
  • Cookies enforce `httpOnly`, `Secure` (HTTPS), and `SameSite=Lax` browser protection flags.
  • Teacher sessions use 30-day sliding windows with per-request CSRF token checks (`te_csrf`).

4. Anti-Bot Gating & Automation Defense

Public authentication, registration, and form submission flows are protected by an automated bot defense system (`bot-check.php`):

  • Integrates Google reCAPTCHA v3 score evaluation (threshold ≥ 0.5) with automatic reCAPTCHA v2 challenge fallbacks.
  • Issued human verification tokens (`consisto_human`) are HMAC-SHA256 signed with restricted 1800-second time-to-live (TTL) expiration windows.

5. WebRTC Live Class Security

Consisto Meet live video streams are encrypted end-to-end in transit using DTLS-SRTP protocols. Participant connection access is authenticated via server-signed short-lived JWT tokens. Meeting room identifiers are managed securely on the server and are never rendered in client DOM or JSON API responses.