shield PLATFORM · SECURITY

Secure by default.

Every tenant's data is fully isolated. Connections are encrypted. Access is role-based. Every action is logged. Security isn't an add-on. It's how the platform is built.

database

Tenant data isolation Every organisation's data is scoped at the database level. Tenant A cannot see, query, or access Tenant B's data under any circumstances. Every query includes a tenant check.

https

HTTPS everywhere All connections are encrypted with TLS. Custom domains get automatic SSL certificate provisioning. No exceptions, no mixed content.

lock

Password security Passwords are hashed with bcrypt (cost factor 12). We never store plaintext passwords. Sessions are regenerated on login to prevent fixation attacks.

admin_panel_settings

Role-based access Five built-in roles with defined permission sets. Users only see and do what their role allows. Org managers are scoped to their department.

key

SSO / SAML Enterprise and Elite plans support Single Sign-On via SAML. Let employees log in with their corporate identity provider. No separate password needed.

history

Audit logging Every significant action is logged: logins, user changes, course edits, enrolments, permission changes. Audit logs are retained and exportable.

security

CSRF protection Every form submission includes a CSRF token. All POST, PUT, and DELETE requests are validated. Cross-site request forgery attacks are blocked by default.

speed

Rate limiting Login, registration, password reset, and API endpoints are rate-limited. Brute-force and credential stuffing attacks are throttled automatically.

Secure sessions Session cookies are httpOnly, secure, and SameSite=Lax. They cannot be read by JavaScript or sent to third-party sites.

Your data. Your control.

You own your data. Always. Export users, courses, enrolments, and progress as CSV at any time. If you cancel, you get 90 days to export everything before it's deleted. We never sell or share your data with third parties.

check_circle Full CSV export

check_circle 90-day retention after cancel

check_circle No third-party data sharing

Questions about security?

We're happy to walk through our security architecture. Book a call or send us your security questionnaire.