Your lessons are the business. Protect them like it.

Piracy is not one problem, so it does not get one setting. Each layer below is toggled on its own from Settings → Security, because the right combination for a $30 recorded course is not the right combination for a live exam-prep cohort.

One student buys, twelve watch. It is the quietest revenue leak in online education, and it is not solved by video protection — it is solved by counting devices.

TKDS LMS caps how many devices can be signed into one account at the same time, and lets you set that cap three ways at once:

Bot signups, credential stuffing and spam through the contact form are the boring, constant attacks. TKDS LMS protects five forms — login, register, forgot-password, contact and complaints — behind one master switch, with a choice of provider:

Accounts authenticate against a bcrypt-hashed password and receive a Laravel Sanctum bearer token, revocable per device. Password reset uses a single-use, time-limited link, and expired tokens are pruned automatically rather than left to pile up.

On top of that, three admission gates can be switched on per install:

Card details go straight to the gateway — Stripe, PayPal, Fawaterk, Tabby or Tamara. Nothing card-related is stored, logged or proxied by the platform, which keeps the PCI burden where it belongs.

Gateway callbacks are verified server-side before they are trusted, so a forged return cannot mark an order paid.

Prices are always resolved from the database at checkout time. A tampered client payload cannot change what an order costs — including partial wallet payments, where the server decides how much balance applies and what the card must cover, and instalments, where each collection is booked independently.

Offline bank transfers require a receipt upload and an explicit admin approval before access is granted, with a rejection reason and a re-upload path rather than a dead end.

Uploads go through a staff-gated media endpoint. Images are re-encoded server-side — resized to ≤1600px and compressed to a hard 500 KB ceiling — which normalises every file and removes the surprises that come with accepting arbitrary binaries.

Instructors see only their own folders and uploads in the media library; admin file management sits behind its own module permission.

Direct messaging is gated by an explicit relationship rule — a follow edge in either direction, or an instructor and a student enrolled in their course. You cannot message a stranger. When real-time push is enabled, the websocket channel is private and authorised per conversation.

Live classes run on TKDS MEETING, self-hosted under your own domain. No third-party meeting provider sits between you and your students, and room access is authorised per join — which is also what produces the attendance record.

The academy owns its data. Students, orders, enrollments, grades, certificates and analytics all export to CSV from the admin panel at any time. There is no contractual clause that holds your content hostage, and no export fee.

We do not sell, rent or share student data, and we do not use it to train models.

Analytics and marketing tags (GA4, Google Tag Manager, Meta Pixel, custom snippets) are opt-in per install and controlled by the academy administrator — nothing is injected by default. Email marketing is SMTP-gated and dormant until an operator configures a mail server, so no message ever leaves under our name.

And because every feature is a switch that is off by default, a capability you do not use ships no routes, no menu items and no attack surface.

Configuration secrets are read through the config layer, never from the environment at runtime. That distinction matters more than it sounds: reading the environment directly returns empty once a production build caches its configuration — and a security control that fails open, silently, is worse than no control at all. We hit that exact bug, fixed it, and now have a test that fails if it comes back.

Every release ships with an automated backend test suite. The security-relevant behaviour — permission scoping, device eviction, entitlement revocation, tamper-safe pricing — has explicit tests rather than manual spot checks.

Paid add-on modules are entitlement-checked continuously. If a licence is revoked the module is removed from the install — pushed immediately, with a scheduled pull as a safety net — while its database tables are preserved, so restoring the licence restores the data intact.

This list is deliberate. Ask any vendor for theirs and watch what happens.

Found something? Email security@tkdsmena.com with enough detail to reproduce it, and give us a reasonable window before disclosing publicly.

We acknowledge within two business days, tell you what we found, and let you know when the fix ships. There is no paid bounty programme yet, but we credit reporters who want the credit.

Please do not run automated scanners against a live customer academy, and do not access, modify or exfiltrate data that is not yours. Test against your own install.