Security

NASH Reviewer holds your account details, your practice history, and any payment confirmations you send us. We protect them in layers: the connection to your device, your account, every request for your data, and the systems that store it.

This page explains what those protections do for you. It leaves out how our systems are built, on purpose, so that it gives no help to anyone trying to attack them. The Privacy Policy explains what data we collect, why, how long we keep it, and which service providers process it.

• Every page and request travels over an encrypted HTTPS connection. Browsers are told to use only secure connections to this site, so a visit cannot quietly fall back to an unencrypted one.
• Account records, practice history, and payment receipt images are encrypted at rest with AES-256 by our hosting provider.

• A dedicated sign-in provider handles passwords and sign-in codes. We never receive or store your password, and our support team will never ask for it.
• You can sign in with Google instead of a password, so your Google account’s own protections, such as 2-Step Verification, apply.
• Your sign-in is checked on our servers every time your data is requested, not just when a page loads.
• Sign-in activity, such as the device, browser, and approximate location, is recorded so that suspicious access can be investigated.
• When you sign out or switch accounts, the app clears the previous account’s data from the browser, so the next person on a shared computer does not see it.

• Only you and our authorized administrators can see your practice history and reports. Other learners cannot see your data.
• Every request for private data is checked on our servers before anything is returned. Hiding a button or a page is never the only protection.
• Administrator access is a separate role, given only to people who need it for their work, and it can be withdrawn at once.
• Every change to premium access records which administrator made it, when, and why.

We do not sell your personal data or publish your assessment history. See Who Can Access Your Data in the Privacy Policy.

• Our pages run only code from us and from the trusted providers we rely on, which blocks scripts that someone might try to inject.
• Other websites cannot show our pages inside their own, a trick used to make people click things they cannot see.
• Another website cannot submit actions to your account while you are signed in. Every action must come from our own pages.
• The site switches off browser features it never needs, including your camera, microphone, location, and payment and USB access.
• Pages that show your data are never kept in your browser’s cache or in shared caches, such as those on school networks.

• Requests are rate limited to stop automated abuse, with enough room for a whole class practicing on one school network.
• Every form and request is checked for its type and size before it is used, and anything unexpected is refused.
• Question timers and scores are kept on our servers. Refreshing the page or changing it in the browser cannot add time or change a score.
• The contact form limits repeated messages, to keep out spam.
• Messages from our service providers, such as account updates, are verified before we act on them.

• We never ask for card numbers, bank or e-wallet passwords, PINs, or one-time codes, and the site has no form that collects them.
• You pay by QR Ph, GCash, or bank transfer through your own bank or e-wallet, to the accounts listed on our Payment Methods page.
• To confirm a payment, we keep only what you send us: the plan, the amount, the transaction number and time, and an optional receipt screenshot.
• Uploaded receipts must be genuine images within a size limit. They are stored privately, and only administrators verifying your payment can view them.

• Passwords, keys, and other secrets are kept out of our code and stored encrypted with our hosting provider.
• Administrative accounts use strong, unique passwords and multi-factor authentication, and work devices use full-disk encryption.
• The service is backed up automatically. Deleting your account removes your practice history, reports, and sign-in activity, as the Privacy Policy describes.
• We review the application’s security, most recently in October 2026, and automated tests check these protections.

We investigate every suspected incident. If a personal data breach meets the legal conditions for notification, we notify the National Privacy Commission and the people affected within 72 hours of learning of it, subject only to exceptions the law allows.

The notice explains what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

• Use the official site, nash.com.ph, and check the address before you sign in.
• Never share your password or sign-in codes. We will never ask for them by email, chat, text, or phone.
• Pay only to the accounts on our Payment Methods page, and confirm payments through our contact page.
• Ignore anyone offering actual or “leaked” NASH questions. No one has them, and DepEd may investigate such offers.
• Use a strong password that you use nowhere else, or sign in with a Google account protected by 2-Step Verification.
• Sign out when you finish on a shared or school computer.
• If you see activity on your account that you do not recognize, or a message pretending to be us, tell us right away.

If you find a vulnerability in NASH Reviewer, please tell us privately so we can fix it before anyone misuses it. We welcome reports from users and security researchers.

How to Report

Email support@nash.com.ph with “Security Report” in the subject. Please include:

• the page or address where the issue occurs;
• the steps to reproduce it;
• what an attacker could do with it; and
• how we can reach you with questions.

Do not include other people’s personal data in your report. Our contact details are also listed in our security.txt file.

Testing Guidelines

• Test only with accounts you own or have permission to use.
• Do not access, change, or delete other people’s data. If you reach any by accident, stop, do not keep a copy, and tell us.
• Do not run denial-of-service, load, or spam tests, or anything that slows the service for learners.
• Do not use phishing or other social engineering against our team or our users, and do not attempt physical access.
• Give us reasonable time to fix the issue before you share it publicly.

Scope

This policy covers nash.com.ph and its pages. Issues in the services of our providers, such as sign-in, hosting, Google, banks, or e-wallets, belong with those providers. Reports from automated scanners need a working example of a real security impact.

What You Can Expect

• We confirm that we received your report.
• We investigate it and keep you informed of our progress.
• We tell you when the issue is fixed.
• With your permission, we credit you for the discovery.

If you follow these guidelines in good faith, we will treat your research as authorized and will not take legal action against you for it. We do not currently pay rewards for reports.

Send security reports and questions to: