Controls
Access control
Multi-factor authentication for all teacher and parent accounts
In progressCriticalVerified 16 September 2026ST4S A4 (Tier 1 = mandated for all non-student accounts)
What this control means
Two-step sign-in with an authenticator app, available to every account from Settings, with a school-wide switch that requires it for all of a school's teachers. Built and reviewed on 16 September 2026; not yet released.
What we found
Authenticator-app enrolment, a code prompt after sign-in, a per-school 'require two-step sign-in' switch, and server-side enforcement are built and under final review. Nothing is enrolled in production yet.
How we verified it
- Enrolment and code checks run against Supabase Auth's MFA service, following its published guide.
- The API refuses requests from accounts that have enrolled, or whose school requires it, until the session has passed a code.
- Support can remove a lost authenticator after confirming identity from the account's own email address.
Still to do
- Release to production.
- Publish screenshots of enrolment and the school switch.
- Recovery codes.
Questions about this control: security@kuraplan.com