Pre-Answered LMS
Security Questionnaire
Accelerate your vendor security review. Pre-answered technical and compliance responses aligned with CAIQ, HECVAT, and SIG Lite standards for IT managers and CISOs.
Personal Academy provides enterprise-grade data governance: database-enforced PostgreSQL Row Level Security (RLS) organisation boundaries, AES-256 encryption at rest, TLS in transit, zero SSO surcharge for SAML 2.0 / SCIM 2.0, and an append-only audit log. AI providers are listed on the sub-processor page. Training on customer data is contractually excluded where the provider offers it — see each provider’s row. Backups are managed by our database provider. We will publish recovery objectives after our first documented restore test.
Architecture & Multi-Tenancy
Q:How is customer organisation data separated at the database level?
Organisation isolation is enforced by PostgreSQL row-level security (RLS) policies bound to the organisation context on every tenant table. It is database-enforced, not only application-enforced, and has been reviewed in our October 2026 security audit (an independent penetration test is not yet commissioned). No part of this is a guarantee against every possible defect.
Q:Are organisation environments hosted in shared or dedicated databases?
Personal Academy uses a shared-schema, isolated-data architecture protected by PostgreSQL RLS. Dedicated or air-gapped deployments are not part of the standard service.
Q:Can we restrict organisation access to specific corporate IP subnets?
Yes. CIDR IP allow-listing can be configured per organisation. IP allow-listing applies to signed-in web sessions.
Identity & Access Management
Q:Does Personal Academy support SAML 2.0 and OIDC Single Sign-On?
Yes. SAML 2.0 and OpenID Connect (OIDC) are supported with identity providers that implement those standards. SSO is included on every paid tier at no additional charge.
Q:Is automated user provisioning and deprovisioning via SCIM 2.0 supported?
Yes. SCIM 2.0 directory synchronisation supports provisioning, role mapping and deprovisioning when an employee leaves the organisation.
Q:Is multi-factor authentication supported?
Two-factor sign-in is available to everyone, and required for administrators and staff.
Q:What role-based access control (RBAC) permissions are available?
System roles plus custom roles you define, each built from a granular permission catalogue.
Encryption & Data Protection
Q:How is data encrypted in transit and at rest?
Data in transit is encrypted with TLS 1.2 or higher, with HSTS on all endpoints. Data at rest is encrypted by our database and storage provider (AES-256).
Q:Can enterprise customers use their own encryption keys?
Not today. Customer-managed encryption keys for stored data are not offered. Organisations can supply their own AI model API keys (OpenAI or Anthropic) for direct metering and isolation.
Audit Logging & Compliance
Q:What audit logging capabilities exist?
An append-only audit log that records privileged actions and sign-in events, with actor, time, IP address and before/after state. Events can be exported from the admin portal.
Q:What controls exist for course sign-off and electronic signatures?
Electronic signatures require a second-factor-verified session and are stored in an append-only ledger with a SHA-256 hash of the signed state. This is not a claim of regulatory certification — confirm any specific regulatory obligation with your own compliance counsel.
Artificial Intelligence Governance
Q:Is customer course or learner data used to train public AI models?
AI providers are listed on the sub-processor page. Training on customer data is contractually excluded where the provider offers it — see each provider’s row.
Q:Can we disable AI features or bring our own model keys?
Yes. AI features can be disabled at the organisation level with a single switch. Organisations can supply their own AI model API keys (OpenAI or Anthropic) for direct metering and isolation.
Backups & Disaster Recovery
Q:What are the Recovery Point Objective and Recovery Time Objective?
Backups are managed by our database provider. We will publish recovery objectives after our first documented restore test.
Vulnerability & Incident Management
Q:How do we report a vulnerability, and how quickly do you respond?
Report it as described under Responsible disclosure on /trust/security. We acknowledge reports within 24 hours. GitHub dependency vulnerability alerts are on for the repository; automated code scanning (CodeQL) is run on demand before a release, not on every change.
Q:How quickly will you notify us of a breach?
We notify customers of a personal-data breach without undue delay and within 72 hours of becoming aware.