Security & Governancefor Enterprise IT Reviewers

PostgreSQL Row Level Security (RLS) enforces organisational data boundaries in the database itself, not only in application code.

• Every organisation possesses an immutable UUID tenant_id stamped on all operational tables.
• Postgres RLS policies enforce `AS RESTRICTIVE` security boundaries on every SELECT, INSERT, UPDATE, and DELETE.
• Session context is established cryptographically through verified Supabase Auth JWTs.
• Database-enforced isolation: row-level security on every tenant table, reviewed in our October 2026 security audit; an independent penetration test is not yet commissioned. It is enforced by Postgres itself, not only by application code.

Turnkey enterprise single sign-on and automated directory synchronization included on all paid plans without an enterprise tax.

• SAML 2.0 and OIDC single sign-on with identity providers that implement those standards.
• SCIM 2.0 automated provisioning and immediate de-provisioning: when an employee leaves, their access is revoked instantly at the IdP.
• Configurable password policies and session length boundaries. Two-factor sign-in is available to everyone, and required for administrators and staff.
• JIT (Just-In-Time) user creation and automated attribute mapping.

Fine-grained access control tailored for corporate hierarchies and external partner training.

• System roles plus custom roles you define, each built from a granular permission catalogue.
• Custom role creation allowing arbitrary assignment of permissions across the permission catalogue.
• Delegated administration: restrict branch managers to specific departments or geographic regions.
• Authorization enforced in both application route middleware and database RPC security definers.

An append-only audit log with sign-in events, designed around SOC 2 and ISO 27001 practices. Not currently SOC 2 certified or ISO 27001 certified. Controls are aligned with those frameworks and not yet independently audited.

• An append-only audit log that records privileged actions and sign-in events, with actor, time, IP address and before/after state.
• Append-only storage model: past events cannot be modified or deleted through the application or its API.
• Exportable via CSV/JSON stream through the admin portal (/api/admin/audit/export) for compliance reviews.
• Customer-initiated SIEM streaming: Automated HMAC-SHA256 event push to Splunk, Microsoft Sentinel, or Datadog.

Strict boundaries on vendor support access: zero permanent administrative backdoors.

• Staff emergency access requires an explicit, time-bounded `platform_access_sessions` escalation record.
• Every action performed during a break-glass session is stamped directly into the organisation’s append-only audit log.
• Hosted on Vercel (application) and Supabase (managed Postgres, authentication and storage). We do not operate our own network or servers.
• Support engineers cannot view learner assessment files without short-lived cryptographic signed URLs.

Modern cryptographic standards protecting data in transit and at rest.

• Data in transit: Data in transit is encrypted with TLS 1.2 or higher, with HSTS on all endpoints.
• Data at rest: Data at rest is encrypted by our database and storage provider (AES-256).
• CIDR IP Allow-Listing: restrict admin portal and/or learner access to corporate IP ranges. IP allow-listing applies to signed-in web sessions.
• Backups are managed by our database provider. We will publish recovery objectives after our first documented restore test.

Architected to satisfy European GDPR Art. 17 and Indian Digital Personal Data Protection (DPDP) Act 2023.

• Configurable per-organisation retention schedules for learner logs and quiz responses.
• Automated pseudonymization of deactivated employee records upon lifecycle expiration.
• One-click Data Subject Rights (DSR) export (/api/account/export) generating complete machine-readable archives.
• Self-service erasure workflows (/api/account/erase) honouring the right to be forgotten. Erased on request within 30 days; backups expire on the provider’s schedule.

Electronic signatures and litigation holds for regulated enterprises. Engineering controls, not a claim of regulatory certification.

• Dual-assertion electronic signature engine: authenticated identity plus a second-factor-verified session.
• SHA-256 state snapshot hash stored in an e_signatures database ledger with triggers preventing updates or deletes.
• Litigation Legal Holds that freeze data purge operations and log formal GDPR erasure refusals (user.erasure_refused) with court case references.
• Ed25519 digital signature licensing for air-gapped on-premises or sovereign cloud private deployments.