# Security — Academium
[View the HTML page](https://academium.com.ng/security/)
> Understand the controls that protect access to Academium, where your records live, and how your school can prepare for recovery.
Built around your school
## Security, from sign-in to backup.
Understand the controls that protect access to Academium, where your records live, and how your school can prepare for recovery.
Last updated 21 October 2026
Security depends on the product, edition, account role and setup you use. Start with the controls available to your school and keep the computers holding its records protected.
## Protect account access
### Passwords and personal PINs
SMS supports a personal PIN on an enrolled computer for quick unlocking. Password changes check the current password and clear existing device trust. Password requirements depend on the account’s role.
### Trusted computers
SMS users can review their trusted devices and remove ones they no longer use. On eligible accounts, idle locking secures the screen after the selected period of inactivity.
### Recovery controls
SMS security questions are protected by a password check. Recovery options depend on the account and edition, so follow the options shown for your account.
### Authenticator settings
SMS provides authenticator setup and backup-code settings, with a password check to disable the setting or replace codes. The sign-in steps available in each product and edition are described in its Help Center.
- [SMS account security guide](https://helpcenter.academium.com.ng/academium-sms/article/sms-account-security)
## Give each role the right access
In SMS, view, add, edit and delete rights belong to staff roles. School owners and authorised administrators manage those roles, with restrictions on who can change higher-level permissions. A staff member’s workspace follows those permissions.
Surepass separates school, instructor, student, parent and independent-teacher workflows. An account’s role and its school or learner relationships determine the work it can access.
- [Explore SMS staff permissions](https://academium.com.ng/sms/features/staff-permissions)
## Manage devices holding records
Authorised SMS administrators can review registered computers, recent activity and application details. Supported devices can be signed out, locked or instructed to wipe their local copy. Availability depends on the edition and device; school-server clients and demo devices have different command limits.
A remote action needs the device to communicate with the service. It does not remove an exported file, a copy on another computer or an existing backup. Report a missing computer promptly and review the affected account’s access.
- [SMS devices and access](https://academium.com.ng/sms/features/devices-and-access)
## Understand local and portal connections
Production connections to the Academium portal use HTTPS. A school’s local server and network are a separate part of the setup: protect the server computer, restrict network access and keep its operating system and applications updated.
Individual Edition can hold records on the employee’s computer for offline work. Protect that computer as well as the server. Portal transport protection does not mean that every local file, local network connection or computer drive is encrypted.
- [Where your information is kept](https://academium.com.ng/privacy#storage-and-sync)
## Prepare for recovery
SMS and Surepass school-server editions create encrypted backups of school records and uploaded files. The documented server implementations use AES-256-GCM and associate backups with the school’s linked portal identity.
Administrators can configure backup schedules and the number of copies retained. Restore checks the archive and its compatibility before replacing the school database. Restoring returns the school to the saved point; work entered later is not recovered by that backup.
Keep a backup on a separate drive and check that scheduled copies are being created. Cloud-backup availability depends on the product, edition and configuration. A successful backup is not a guarantee against every kind of data loss.
- [School-server backup guide](https://helpcenter.academium.com.ng/academium-sms/article/sms-backing-up-and-restoring)
## Your school’s part
- Use individual staff accounts and keep passwords, PINs, recovery answers and sign-in codes private.
- Review roles and device access when staff join, change responsibilities or leave.
- Lock computers when unattended, install updates, and limit physical access to the school server.
- Keep recovery copies separate from the main drive and review server warnings about storage or missing backups.
## Report a security concern
If you suspect unauthorised access, contact your school administrator and Academium support. Include the affected product, the approximate time and a description of what you observed. Do not send passwords, PINs, backup codes or unnecessary student records.
For a suspected software vulnerability, email support with enough detail for us to investigate privately. Service incidents and availability information are published on the status page.
- [support@academium.com.ng](mailto:support@academium.com.ng?subject=Security%20concern)
- [Academium system status](https://status.codeindevelopers.com.ng/academium/)