MUBAS Alumni Association

Security

Last updated 20 October 2026

The MUBAS Alumni database holds personal details, so we protect it carefully. This page explains what the Association does to keep your information safe, and what you can do to help.

What we do

Your account and password

  • Passwords are stored in scrambled (hashed) form. Nobody, including administrators, can read your password.
  • When you register, we generate a strong random password for you instead of using a shared default.
  • New passwords must be at least 8 characters with letters and numbers, and a strength meter shows how strong yours is.
  • After several wrong sign-in attempts, sign-in is temporarily locked to stop password guessing.
  • You must enter your current password to change it. When you change a password, every other device signed in to your account is signed out.
  • Password reset links are sent only by email, and the reset form gives the same answer whether or not an email is registered, so it cannot be used to find out who is a member.

Who can see your information

  • Alumni records are checked by the Association before they appear to other alumni. Only verified alumni can search the directory or open other profiles.
  • Other alumni always see your title, name and programme. They see your contact, work and location details only if you choose to share them, and you can change that at any time.
  • Staff only see the alumni in the schools and departments they have been assigned. Staff with no assignment see nobody.
  • Your profile photo is a private file. It is shown only to signed-in people who are allowed to see your profile, and it is never available through a public link.
  • Photos you upload are re-processed on our server, which removes hidden data such as the location a photo was taken, and limited to 3 MB.

Accountability

  • Every verification, rejection, edit, photo change and deletion of an alumni record is written to an audit trail that records who did it and when.
  • Sign-ins, including failed ones, are logged with the time, device type, browser and IP address, to spot misuse and see how the site is used. Records are deleted after 12 months.
  • Only administrators can manage users, schools, programmes and announcements, and only administrators can ban an account. Bans, and the reason for them, are recorded in the audit trail.

The site itself

  • Forms are protected against forged requests, and the site cannot be embedded inside other websites.
  • Announcement text is cleaned before it is stored and shown, and everything else you or others type is displayed as plain text, so it cannot run harmful code in your browser.
  • Registration, directory search and password changes are rate-limited to slow down automated abuse.
  • Password hashes and other secrets are kept out of our log files.
  • Announcement emails include a link to unsubscribe, and the link only works if it was issued to you.
  • Over a secure (HTTPS) connection, the site tells your browser to keep using HTTPS.

How you can protect yourself

  • Save your password safely. The password shown when you register appears once. Store it in a password manager, then change it in Settings to one only you know.
  • Use a password you use nowhere else, and do not share it with anyone, including friends, classmates or people who say they are from the Association.
  • Be careful with email. The Association will never ask for your password by email, message or phone. If a message asks for it, do not reply or click the links. Go to the site by typing its address yourself.
  • Check where you are. Make sure the address is correct and the page is secure (a padlock in the address bar) before you sign in.
  • Sign out on shared or public computers, and do not let your browser remember your password there.
  • Keep your email account secure, because password reset links are sent there. Use a strong password on it too.
  • Share only what you need. Review your Preferences and privacy settings, and keep contact, work and location details hidden unless you want other alumni to see them.
  • Choose your photo with care. Use a photo of yourself that you are comfortable with other verified alumni seeing.
  • Keep your devices up to date, with the latest browser and system updates and a screen lock.
  • Update your details. If you change your email address or phone number, update your profile so we can reach you if something is wrong.

If something looks wrong

If you think someone else has used your account, change your password straight away (this signs out other devices), then tell the Association. Please also report a suspicious message, a page that looks like this site but is not, or anything that looks like a weakness in the site. Do not share details of a suspected weakness publicly. Contact the MUBAS Alumni Association through its office.

No system can be made perfectly secure. We review these measures regularly and will update this page when they change. See also our Privacy Policy.

Questions about this page? Contact the MUBAS Alumni Association through its office.