Security and trust

Courier — 30 October 2026

Who builds it, and how

RSJ Software Ltd is a one-person company. Courier is written with AI coding tools, under rules enforced by the tools rather than left to good intentions:

• Tests before publishing. A suite of automated tests and code checks must pass before any change is published. It includes tests that who may send what is enforced, that permissions stay inside their scope, and that nothing is sent twice.
• Independent review before publishing. Every code change is read by a second AI model that did not write it. Changes to sign-in, accounts, Active Directory, certificates, updates and the installer are also read by a model from a different company. A check on the code repository refuses to publish code that has not been reviewed.
• Real installs. Builds are installed on a small test network (Windows Server 2022 virtual machines in an Active Directory domain, with test PCs). Sending, delivery to signed-in, locked and signed-out PCs, reading Active Directory, and updating from the Beta channel have each been tried there. Some situations have not been tried on real PCs yet, such as one person on two PCs at once; the release notes say which.

What runs where

• The Courier server runs on a Windows server you choose, as a Windows service under the low-privilege Local Service account. It answers only over HTTPS. It uses its own certificate by default, or your school’s own.
• The console can be opened from the school network, behind sign-in. An administrator can limit it to listed addresses. The first administrator account can only be created on the server itself.
• Its data (accounts, audiences, notices and delivery records) stays on that server, in a folder only SYSTEM, Administrators and the Courier service can open. Notice history is kept for 365 days by default; you can choose from 90 days to 5 years.
• The PCs run the RSJ Agent with the Courier module, which shows notices and reports back to your Courier server, never to us.

What leaves your network

That is all. There is no licence check, no usage reporting and no error reporting to us. If you want our help, you download a support bundle and choose to send it yourself.

Installers and updates

• Releases are code-signed by RSJ Software Ltd (Microsoft’s Azure Artifact Signing).
• Python packages are installed into the build only from a list that fixes each package’s version and its SHA-256 checksum. A new package needs a deliberate decision and a check on who publishes it.
• When an update is installed, Courier first checks the download against the SHA-256 checksum published with the release. A separate task, running as SYSTEM, then checks four things before it runs the installer: that Windows considers the signature valid, that the signer is RSJ Software Ltd, and that the product and version are the ones expected. It also refuses to go back to an older version.
• The RSJ Agent on your PCs refuses an update or a module that RSJ Software Ltd did not sign. Every file in a module must also be listed, with its checksum, in a signed list. An administrator on that PC can deliberately switch this check off, for testing. The agent logs a warning each time.

How notices reach PCs

• PCs connect to your server over HTTPS and check its certificate against a fingerprint they were given, or against certificates Windows already trusts. A different certificate is refused.
• A PC must present two things: the school’s agent secret, and its own key, issued on its first contact. Only a hash of each PC’s key is stored. A PC cannot read or acknowledge another PC’s notices.
• Notices are plain text with simple formatting (bold, italic). They carry no web code, and addresses in a notice are never turned into links.
• Each notice is not separately signed. Its protection is the HTTPS connection to the server the PC trusts. Anyone who controls your Courier server can send notices, so protect it as you would any server that can reach every PC.

Accounts, sign-in and stored secrets

• There are two roles. Administrators manage Courier. Senders may send only to the audiences an administrator has given them, within any daily and per-notice limits set for them. These rules are checked when the notice is stored.
• Passwords are stored as PBKDF2-SHA256 hashes (600,000 rounds, with a salt for each password), and must be at least 10 characters long.
• After five wrong passwords from one address, that address is blocked for a minute. The count survives a restart. It is per address, not per account.
• Sessions last 8 hours. Session cookies are HttpOnly, Secure and SameSite=Strict. Every change needs a per-session token and is refused if it comes from another website. The console’s pages are served with a strict Content-Security-Policy.
• The Active Directory password and the update token are encrypted with Windows DPAPI for the Courier service. Backups are encrypted with a password you choose.

What we have not done yet

• No independent penetration test or code audit.
• No security certification (such as ISO 27001 or SOC 2).
• No two-factor sign-in yet. It is built and being reviewed.
• The sign-in lockout is per address, as above, not per account.
• Any device holding the school’s agent secret can register itself as a new PC. If the secret may have leaked, rotate it in Agent Settings; every PC must then be enrolled again.
• Courier is in public beta. It is not an emergency or safeguarding alert system, and delivery is not guaranteed.

Reporting a security problem

Please email security@rsjsoftware.com rather than posting publicly. Our security policy sets out what to include, how quickly we respond, and our target times for fixes by severity. We do not take legal action against good-faith research. There is no paid bug bounty, but we credit reporters who would like it.