About AccredAdept
AccredAdept is a shared workspace for physical therapist assistant programs preparing for accreditation with the Commission on Accreditation in Physical Therapy Education (CAPTE). It brings the pieces of a self-study into one place: the CAPTE Section 1–7 standards and their required elements, a question bank mapped to standards, a program evidence library, and narrative responses drafted directly against each standard.
Program directors use AccredAdept to organize and compile the Self-Study Report. Faculty use it to submit exam questions, upload assessments, and attach evidence — with program directors and administrators controlling what each person can see and do.
Security overview
The list below is a technical summary of the security measures built into the platform, written for readers with an IT or security background.
- Transport encryption
- All traffic served over HTTPS (TLS 1.2+); unencrypted HTTP requests are redirected at the edge. HSTS enforced by the hosting layer.
- Authentication
- Email/password authentication with salted, per-user password hashing. Sessions use short-lived signed JWT access tokens with rotating refresh tokens; tokens are validated server-side on every privileged request.
- Authorization model
- Database-level Row Level Security (RLS) on every table. Policies scope each row to the owning program and user, so queries return only records the caller is entitled to see — independent of the application UI.
- Role-based access control
- Roles (administrator, program director, faculty) are stored in a dedicated roles table and evaluated server-side through security-definer functions. Role checks are never performed in the browser and cannot be modified by client input.
- File uploads
- Accepted uploads are restricted to PDF and Word document types, processed on the server rather than in the browser, and stored in private storage. Program documents are only reachable by members of that program.
- Secrets and API access
- API keys and service credentials are held server-side only and are never included in the code delivered to the browser. Privileged database access is limited to explicit service-role grants.
- Input handling
- All server endpoints validate and type-check incoming payloads before processing. Server endpoints exposed to external callers verify the caller and reject unauthenticated writes.