Security & trust
Built to keep every institution’s data its own
Each institution’s data, kept apart
Every record carries the institution it belongs to, and the database itself enforces that no one, including our own server code, can read or change another institution’s data. Automated tests check this on every change before it ships.
Sign-in you control
Learners and staff are routed to their own campus by email domain. Institutions can connect Microsoft Entra ID, Google Workspace or any SAML 2.0 provider, and require single sign-on for their domains.
Least privilege inside each campus
Roles (super admin, course admin, teacher, teaching assistant, admissions, IT) only see the courses and data they need.
Encryption
All traffic is encrypted in transit with TLS, including on custom domains, where certificates are issued automatically. Data is stored on infrastructure that encrypts it at rest.
Safe uploads and code
Uploaded images are checked by their contents, not their names. Learner code runs in isolated, short-lived sandboxes.
Accountability
Staff actions on enrolments, roles, programs and certificates are recorded in an audit log; platform operations are logged separately.
Accessibility
Themes are checked for readable contrast (WCAG AA), and learners can adjust text size, contrast and motion.
On our roadmap
Independent security certification (SOC 2 Type II), a published accessibility conformance report (VPAT), regional data hosting and dedicated environments for large institutions. We'll only list these here as complete once they are.
Ask our team about security →