Security

Last updated 20 October 2026

Every item below is something the Hub does today.

• Card details never reach NovaEd. They are entered on PayFast's page. We only receive a result.
• Card results are checked three ways before anything is switched on: PayFast's digital signature, the amount paid against the amount ordered, and a confirmation request back to PayFast itself.
• Alipay results are checked against Alipay's digital signature (RSA2) and confirmed by asking Alipay directly.
• Orders cannot be faked. Every message between this site and the NovaEd school platform is signed with a shared secret (HMAC-SHA256) and compared in a way that resists timing attacks. An unsigned or wrongly signed request is rejected.
• Nothing is switched on twice. A paid order is recognised and not credited again.
• Confirmations go only to NovaEd addresses over HTTPS.
• School Codes are random and cannot be worked out from a school's name or number. Repeated look-ups from one address are slowed down.
• Requests are size-limited, and secrets and keys are kept outside the code, in server settings.
• Data is encrypted in transit (HTTPS).

If you think something looks wrong on a payment, tell us straight away through Support.