PCIC
Pagadian City International College — Secured Sign-In

You are signing in to the PCIC Digital Campus Portal. This console protects student records, faculty profiles, admissions and registrar data, transcripts of records, and personnel files — every byte of which is governed by the Data Privacy Act of 2012 (RA 10173).

"Makapasalig ko: this system is built to be secure, stable, and long-term."

For 25 years, the Pagadian Sangguniang Panlungsod Legislative Tracking System has been running since 2000—proof nga kung tarong ang design, maintenance, ug discipline, ang system molungtad gyud. That same mindset is what I bring now as a solo developer: careful with data, strict sa security, and guided by modern standards.

Even if desktops or laptops fail, mapulihan ra na. Ang importante, the data remains protected through encrypted off-site backups, secure authentication, encrypted storage, and safe connections. No shortcuts, no unnecessary risk, no surprises—just a reliable system nga ready for real government use.

Dako pud akong pasalamat sa akong friend nga si Mario, who helped shape my technical foundation in programming. He is a highly technical person, with a family background deeply rooted in science and technology, including a sibling who is a scientist. Through his guidance, I learned not just how to code, but how to think like a real developer—structured, careful, logical, and solution-oriented.

Sa akong experience pud as a building designer, na-train ko through Bentley Systems in designing and understanding low-rise, mid-rise, and high-rise buildings. Because of that, nadala nako ang engineering mindset sa software development: accuracy, structure, documentation, safety, load capacity, and long-term durability. Para nako, software is like a building. Kung lig-on ang foundation, klaro ang structure, sakto ang design, ug tarong ang maintenance, it can serve people reliably for many years.

Mao ni akong commitment: dili lang ko maghimo og system nga nindot tan-awon, but a system nga kasaligan, secure, and practical for daily government operations. Ang goal is simple but serious: to protect public information with the same care we give to the Sangguniang archives—secure, organized, and ready for the next generation.

• Argon2id password hashing — memory-hard, GPU-resistant. 64 MB · t=3 · OWASP 2024 recommendation. Legacy hashes auto-upgrade on first login.
• Zero SQL-injection surface — PDO prepared statements with emulation disabled. There is no string path from input to the SQL engine.
• 256-bit CSRF tokens — single-use, intent-scoped, constant-time compared. Cross-site form submissions are rejected before any auth code runs.
• Account lockout — 5 failed attempts triggers a 15-minute hold using the existing login_attempts + locked_until columns. No data dropped, no schema change.
• Session hardening — HttpOnly · Secure · SameSite=Strict cookies. Session ID rotated on every privilege change.
• TLS 1.3 + HSTS preload — browsers refuse plaintext HTTP to this domain even on first visit.
• User-enumeration mask — wrong-username and wrong-password responses take the same time. Attackers can't tell which is which.
• RA 10173 compliant — purpose-limited collection, minimal fields, retention per NPC Circular 16-01, named Data Protection Officer.