Your data is safe with Labbaik.

Payment security

All payments processed through Labbaik are handled entirely by Stripe — a PCI DSS Level 1 certified payment processor. This is the highest level of payment security certification in the industry. Labbaik never stores, sees, or touches card details. All sensitive payment data is transmitted directly to Stripe's certified servers and never passes through Labbaik's infrastructure.

Data storage & infrastructure

All Labbaik data — including student records, attendance logs, and parent information — is stored on Supabase, a platform that is independently audited and certified to the following standards:

All data is encrypted at rest using AES-256 and in transit via TLS. Each institution's data is fully isolated from other organisations on the platform using row-level security (RLS) enforced at the database level — a Labbaik organisation can never access another organisation's data.

UK data protection

Labbaik Labs is registered with the Information Commissioner's Office (ICO) under UK GDPR. We process personal data — including student records and parent contact details — in accordance with UK data protection law. Student data is never sold, shared with third parties, or used for advertising purposes.

Access control

Access to data within Labbaik is strictly role-based. Teachers can only see students in their assigned class. Admins can only see their own organisation's data. Parents can only see their own children. These controls are enforced at the database level — not just in the application — so they cannot be bypassed. All authentication is handled by Supabase Auth with support for passwordless magic-link login for parents.

Third-party connections

Labbaik offers optional connections to Google Drive, Dropbox, and Zoom, using OAuth — the same industry-standard authorisation Google, Dropbox, and Zoom themselves use for third-party apps. Labbaik never sees or stores your password for these services; you authorise access directly with the provider, and you can revoke it at any time from your account settings or directly with the provider.

Each connection is scoped to the minimum access needed:

Google Drive — file-scope access only. Labbaik can only see files it creates on your behalf or that you explicitly select through the connection; we cannot browse, list, or access the rest of your Drive.
Dropbox — App Folder access only. Labbaik's connection is confined to its own dedicated folder inside your Dropbox; we cannot see or access any other files in your account.
Zoom — used only to create and manage video meetings for your classes and events on your organisation's behalf; it does not grant access to files or any other Zoom account data.

OAuth tokens are encrypted at rest, transmitted over TLS, and refreshed automatically without your login credentials ever passing through or being stored by Labbaik.

Your data, your control

The data you enter into Labbaik belongs to your institution — not to Labbaik. You retain full ownership of all student records, attendance logs, parent contact details, and financial information stored on the platform.

You can request a full export of your organisation's data at any time, for any reason, with no charge. We will provide your data in a structured, commonly used machine-readable format within 72 hours of a written request to privacy@uselabbaik.com.

Labbaik is built to be reliable. We target 99.9% uptime for all institutions on the platform. Email support is available to all users with a target first-response time of 48 hours during business days. Manzil plan customers receive priority support with a target first-response time of 4 hours and a dedicated account manager.

Found a security issue?

We take vulnerability reports seriously. If you've discovered a security issue in Labbaik, please contact us directly rather than disclosing it publicly. We'll acknowledge your report within 24 hours and keep you updated as we investigate.

salam@uselabbaik.com