Security

Accounts and sign-in

Passwords are hashed with scrypt using per-password parameters recorded alongside the hash, so the cost can be raised later without locking anybody out. Sessions are signed tokens with their expiry inside the signature — a browser cannot extend its own session by editing a cookie.

Single sign-on is per-organisation OpenID Connect, using the authorization-code flow with the token exchanged server to server. An organisation's identity provider is authoritative only for its own verified email domain, and can never assume a platform administrator or instructor account. A directory reaching for an account it has no claim to is recorded as a failed sign-in.

Separation between customers

Every console route is scoped to the organisation of the person making the request, and that scoping is verified automatically: an automated suite attempts every organisation-scoped route as a member of a *different* organisation on every change, and a route that answers is a failure that blocks the deployment.

What we record

Privileged actions — role changes, access grants and revocations, credential issue and revocation, organisation and billing changes, sign-in failures — are written to an append-only audit log with the actor, the subject, what changed, and the request's origin. There is no code path anywhere in the application that updates or deletes an audit entry, and that absence is checked automatically.

Rate limits

Sign-in, password reset, registration, contact submission and the partner API are rate limited. A limit that is hit returns a Retry-After telling an integrator when to come back rather than failing silently.

Uploaded content

Course packages uploaded by authors are scanned before they are accepted. A package that references scripts or frames from another origin is rejected, not sanitised, because the alternative is running somebody else's code inside a page that is already signed in. What the scan does and does not catch is documented rather than implied.

Data location and retention

Data is held in the United Kingdom. Retention periods are set out in our Privacy Notice. Under an erasure request an account is anonymised while issued certificates keep the name they were issued under, because third parties have relied on them — this is explained on the deletion screen before anyone confirms.

What we have not built

We would rather say this than let a questionnaire imply otherwise:

• There is no bug bounty programme. Please email us; we will acknowledge within two working days.
• We have not completed an external penetration test.
• We do not hold ISO 27001 or SOC 2 certification.
• Single sign-on domains are set by us during onboarding rather than proved by a DNS record.

Reporting something

If you believe you have found a vulnerability, contact us with enough detail to reproduce it. Please do not test against other customers' data. We will confirm receipt, keep you updated, and credit you if you would like us to. (rewritten)