PLATFORM · SECURITY

Secure by default.

Every workspace's data is kept apart and encrypted with its own key. Connections are encrypted. Access is role-based. Every significant action is logged. Security is how the platform is built, not an add-on.

Book a walkthrough Security and data protection

Buying for your organisation?

The security and data protection overview for buyers and procurement covers hosting, backups, sub-processors and the controls in place.

Trust and security
Workspace isolation Every row of customer data carries its workspace, and every query is limited to that workspace. Each workspace's personal data is encrypted with its own key, and one workspace's public pages never open on another's address.
HTTPS everywhere Every connection uses TLS 1.2 or later, with HSTS. Custom domains are served over HTTPS, with a certificate we issue for you automatically.
Password security Passwords are hashed with bcrypt (cost factor 12) and never stored in plain text. Common and easily guessed passwords are refused. Sessions are regenerated at sign-in to prevent fixation attacks.
Role-based access Six built-in roles, and your administrators can adjust what each one may do in the role editor. Every permission is enforced: people only see and do what their role allows, and organisation managers are limited to their own organisations.
SSO and SCIM provisioning Single sign-on through SAML with signature checks, so people sign in with their organisation's identity provider. SCIM creates and removes their accounts from that identity provider. On the Provider Plus and Group plans, and Enterprise and Elite for employers.
Audit trail Every significant action is logged: sign-ins, user changes, course edits, enrolments, permission changes, and actions taken through AI assistants or the API. Entries are kept for as long as you are a customer. Exam unlocks, transfers and attendance keep their full history on the delegate record.
CSRF protection Every form and every change carries a CSRF token, which is checked on the server. Cross-site request forgery is blocked by default.
Rate limiting Sign-in, registration, password reset and the APIs are rate limited in the platform. Brute-force and credential-stuffing attempts are throttled automatically.
Secure sessions Each workspace address has its own session cookie, which JavaScript cannot read and which is only sent over HTTPS. Sessions end at sign-out or after 120 minutes without activity. Because single sign-on posts back from your identity provider, the cookie allows cross-site requests, and CSRF tokens protect every change.
Encrypted personal data Names, email addresses and other personal data are encrypted at rest with AES-256-GCM, with a key per workspace. Finding someone by email uses a keyed hash, so lookups never need the plain value.
Two-factor sign-in Standard on every plan: codes from any authenticator app, on top of a password or single sign-on. Administrators can require it for everyone or for chosen roles, and can reset a lost authenticator.
AI assistant connections Assistants such as Claude or ChatGPT connect through OAuth sign-in and act with only the permissions of the person who connected them. Changes that email people or move money are previewed and confirmed first, and every change is in the audit trail.

Your data. Your control.

You own your data. Export people, bookings and course progress as CSV at any time, or download everything as one archive. If you cancel, your administrators keep export access for 30 days, then your workspace is deleted. Learner records (completions, certificates, attendance and results) are kept sealed and encrypted for 6 years, then deleted. We never sell your data, and the companies that process it on our behalf are listed on the trust page.

CSV export and a full archive
30 days to export after cancelling
We never sell your data

Questions about security?

We're happy to walk through our security architecture, or send us your security questionnaire and we will complete it.

Book a walkthrough Security and data protection