Trust Centre
Published by the Information Security, Privacy, and Engineering Governance Teams at Personal Academy. Verifiable controls, multi-tenant isolation guarantees, and comprehensive compliance disclosures.
Trust is earned through verifiable technical controls, not marketing assurances. Personal Academy combines PostgreSQL kernel-enforced data partitioning (RLS), zero-trust identity governance (SAML 2.0 & SCIM 2.0 included on every paid plan at zero surcharge), isolated opaque-origin sandboxing for untrusted SCORM content, and an auditable, strictly governed AI Gateway with zero training on customer IP.
Certification status
Personal Academy has not undergone a SOC 2 audit and does not hold any third-party security certification today. What follows is a truthful account of the controls we operate — verifiable against our source — and the roadmap for formal certification. We would rather show you the real state of the system than claim a status we have not earned.
No audit report exists yet. When one is completed, a request/download link appears here — this section is the only thing that changes.
Roadmap
- •Controls below are operated today and are the basis a future audit would test.
- •A SOC 2 Type II audit requires an observation period after controls are in place; we have not yet started the clock.
- •When an audit is scheduled, this page will say so with a date. When a report exists, it will be linked or requestable from the slot above — this page does not need to be rebuilt to add it.
Compliance & Framework Alignment Matrix
How Personal Academy technical architecture and operational safeguards align with major international frameworks.
| Standard / Framework | Scope & Relevance | Technical & Operational Controls | Status |
|---|---|---|---|
| SOC 2 Type II (Common Criteria) | Security, Confidentiality, and Availability across SaaS operations. | Continuous RLS isolation enforcement, automated CI/CD security scanning, least-privilege administrative access, append-only immutable audit logging, and automated daily backups. | Controls Aligned (Audit observation scheduled) |
| ISO/IEC 27001:2022 (ISMS) | Information Security Management System controls (A.5 through A.8). | Documented security policies, annual vendor risk assessments, structured incident management runbooks, cryptographic key governance, and formal change control. | ISMS Framework Aligned |
| GDPR & UK GDPR (EU 2016/679) | Data protection, international data transfers, and data subject rights. | Standard pre-signed DPA incorporating EU SCCs, self-service user data export (Art. 15/20) and complete account erasure (Art. 17), 72-hour breach notice procedure, and strict 30-day sub-processor change notice. | Fully GDPR-Ready |
| EU AI Act (Regulation 2024/1689) | AI governance, transparency, and high-risk educational system avoidance. | Public AI Feature Register, mandatory transparency disclosures for conversational AI, non-consequential advisory scoring, human review override requirements (ai.decision.review), and non-training vendor terms. | Deployer Compliance Ready |
| OWASP Top 10 & ASVS L2 | Web application vulnerability hardening and threat resistance. | Edge Middleware parameterized queries, nonced CSP Level 3, automated dependency vulnerability alerts (CodeQL, Dependabot), and strict input validation via runtime schema validation (Zod). | Hardened Baseline |
Security posture
Controls we operate today, each traceable to the code that implements it — not adjectives.
Tenant isolation by restrictive row-level security
Every business table carries a tenant_id column and an AS RESTRICTIVE tenant_boundary policy, enforced by Postgres itself on every query — not by application code remembering to filter.
Permission-based authorisation
Access decisions go through has_permission(key), checked against a granular permission catalogue and each organisation’s own role definitions — both in RLS and in route handlers. Application code never branches on a role name.
Append-only audit log
Privileged actions and sign-in events are recorded in audit_events with actor, tenant, before/after state and a timestamp. The log is append-only for every API role: rows cannot be updated or deleted through the application or its API.
Module entitlements read per request
What an organisation is entitled to is looked up on every request, never stamped into the session token. A downgrade or an entitlement change takes effect immediately instead of waiting up to an hour for a token to expire.
Self-service data export and erasure
Any signed-in person can download a complete export of their own data (GDPR Art. 15/20) or request erasure across every organisation they belong to (GDPR Art. 17), typing their email to confirm.
Time-boxed, attributed break-glass access
When platform staff need temporary access to an organisation’s data for support, the session has an explicit expiry, a required reason, and is tied to the staff member’s own identity — not a standing administrative account.
Not yet built
Independent penetration test
No third-party penetration test has been commissioned yet.
Published recovery objectives
Backups are managed by our database provider. We will publish recovery objectives after our first documented restore test.
Authorized Sub-Processors Register
Third parties who process data on our behalf to deliver the platform. We provide at least 30 days prior written notice before authorizing any new sub-processor.
| Sub-Processor | Purpose & Service | Data Processed | Location | Trust Link |
|---|---|---|---|---|
Supabase | Primary database, authentication provider, object storage and serverless (edge function) runtime for the whole platform. Database backups are managed by Supabase. | All application data: accounts, course content, learner progress, audit events, and files uploaded to course materials storage. Account and profile dataCourse content and learner progressAudit eventsUploaded files | Managed Postgres, authentication, storage and edge-function hosting (region set at project creation). | Trust Page |
Vercel | Hosts the production build of the Next.js application, edge delivery and web analytics. | The built application (compiled code, not a copy of the database), its HTTPS traffic, request metadata and cookieless page-view counts. Request metadata (IP address, user agent)Page-view counts | Vercel’s build and edge network (US-based operator). | Trust Page |
OpenRouter | Single gateway to third-party language models, so the platform is not locked to one model vendor. | Prompts and generated content for AI-powered activities (coaching, content generation, quiz assistance) — routed to the underlying model configured per activity. Guardrails keep untrusted user content out of the system prompt before it leaves our servers. Text, speech and transcription run under zero data retention. Image and video generation (only where an organisation switches on "Image and video generation without zero data retention") use a separate key under which the image or video provider may keep the prompt and the output for a short time. AI prompts and generated contentImage and video prompts and outputs (not under zero data retention, organisation opt-in) | United States (model routing service; the downstream provider is configurable per AI activity). | Trust Page |
Anthropic | AI model provider, and the AI assistant our support team uses to triage support requests and draft replies. | AI prompts and generated content, when an AI activity is configured to use a Claude model (via OpenRouter or direct). For support: the support emails, chat transcripts and tickets our team processes with Claude to triage them and draft replies. AI prompts and generated contentSupport messages and the names and email addresses in them | United States. | Trust Page |
OpenAI | AI model provider. | AI prompts and generated content, when an AI activity is configured to use an OpenAI model (via OpenRouter or direct). AI prompts and generated content | United States. | Trust Page |
Google Gemini | AI model provider. | AI prompts and generated content, when an AI activity is configured to use a Gemini model. AI prompts and generated content | United States / EU (Google infrastructure). | Trust Page |
ElevenLabs | Text-to-speech for course narration. | Lesson narration text sent for speech synthesis, only when course narration is generated. Narration text | United States / EU. | Trust Page |
Resend (or the organisation’s own SMTP provider) | Email delivery (invitations, reminders, alerts, receipts). | Recipient email addresses, names and message bodies of transactional and notification emails. Email address and nameNotification content | United States (Resend); the organisation’s own provider where SMTP is configured. | Trust Page |
Google Workspace | Email sending (SMTP relay for transactional and notification email) and our support and contact mailboxes. | Recipient email addresses, names and message bodies of emails sent through Google Workspace SMTP, and the messages people send to our support and contact mailboxes. Email address and nameNotification contentSupport messages | United States / EU (Google infrastructure). | Trust Page |
Sentry (only when error monitoring is switched on) | Error monitoring, so faults are found and fixed. | Error reports and performance traces: stack traces, the page or API route, browser and device type, and the internal user ID. Email addresses, IP addresses, cookies, request bodies and tokens are removed before a report is sent. Error reportsInternal user IDBrowser and device metadata | United States / EU (region chosen when the Sentry organisation is created). | Trust Page |
Razorpay | Payments and subscription billing. | Payment card, UPI and net-banking details, billing contact info. Payment details (held by Razorpay, not by us)Billing contact | India. | Trust Page |
Stripe (only where an organisation connects its own account) | Organisation-configured payments for storefront sales. | Payment details for that organisation’s own storefront sales, held by Stripe on behalf of the organisation. Payment details (held by Stripe)Billing contact | United States / EU (Stripe infrastructure). | Trust Page |
Browser push services (Google, Apple, Mozilla, Microsoft) | Delivering web-push notifications. | A push subscription endpoint and the notification payload, only for people who opt in to browser notifications. Push subscription endpointNotification content | Operated by the browser vendor. | Trust Page |
Google Analytics / Tag Manager | Website analytics. | Cookies (_ga, _ga_*), page views, device and browser metadata — public website only, after consent. Cookie identifiersPage viewsDevice and browser metadata | United States / EU (Google infrastructure). | Trust Page |
Meta Platforms (Pixel) | Marketing attribution. | Cookies (_fbp), page views, conversion events — public website only, after consent. Cookie identifiersPage viewsConversion events | United States (Meta infrastructure). | Trust Page |
Google Ads (conversion tag) | Measuring which advertisements lead to sign-ups. | Cookies (_gcl_au), ad-click identifiers and conversion events — public website only, after marketing consent. Cookie identifiersAd-click identifiersConversion events | United States / EU (Google infrastructure). | Trust Page |
LinkedIn (Insight Tag) | Marketing attribution for LinkedIn campaigns. | Cookies (li_fat_id), page views, device metadata and conversion events — public website only, after marketing consent. Cookie identifiersPage viewsDevice and browser metadataConversion events | United States / EU (LinkedIn infrastructure). | Trust Page |
Postmark and SendGrid (only where selected as the email provider) | Alternative email delivery providers and sending-domain verification. | Recipient email addresses, names and message bodies, only when EMAIL_PROVIDER or an organisation’s sending domain is set to one of these vendors. Email address and nameNotification content | United States. | Trust Page |
Pexels | Stock imagery for course authoring. | Search keywords typed by a course author when searching stock photos or video; no learner data. Search keywords | United States / EU. | Trust Page |
Integrations an organisation connects itself (Slack, Microsoft Teams and 365, Google Calendar and YouTube, Salesforce, HubSpot, LinkedIn Learning, Canva) | Customer-initiated integrations. Not engaged by us on a customer’s behalf; listed for transparency. | Only the data an organisation administrator chooses to sync (for example names, email addresses, completion records, calendar events) after that administrator authorises the connection with the vendor. Names and email addressesLearning completionsCalendar events | Per vendor; chosen and controlled by the customer. | Trust Page |
Learning Record Store an organisation names (xAPI forwarding and import) | Customer-initiated xAPI connection, configured by an organisation administrator in Admin > LRS. Not engaged by us on a customer’s behalf; listed for transparency. | xAPI statements (who did what learning, when, with what result). Forwarding sends copies of the organisation’s statements to that LRS; import pulls statements from that LRS at the customer’s instruction (statements pulled from a customer-named LRS at the customer’s instruction). Learner identifiersLearning activity and results | Per vendor; chosen and controlled by the customer. | Trust Page |
Microsoft Teams bot connector (chat-native learning) | Customer-initiated chat app (CHT). Only engaged once an organisation administrator installs the Academy app in their Microsoft Teams tenant; listed for transparency. | Replies and cards the Academy bot posts into a Teams chat the organisation installed it in: the message text, buttons and the Teams conversation and user identifiers needed to deliver them. Chat messages sent by the botTeams user and conversation identifiers | Per vendor; chosen and controlled by the customer. | Trust Page |
Content-library providers an organisation connects itself (Percipio, Udemy Business, Go1, edX, Microsoft Learn) | Third-party course catalogues an organisation licenses. | Catalogue and enrolment requests made with credentials the organisation supplies; learner identifiers only where the organisation enables enrolment sync. Course catalogue metadataEnrolment identifiers | Per vendor; chosen and controlled by the customer. | Trust Page |
Google (Gmail and Google Drive connectors) | Customer-initiated connector for ambient learning (Gmail, Google Drive). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator (or, for Gmail, the individual worker) authorises, to read the mailbox message metadata or Drive files that connection is scoped to so they can be matched to learning in the flow of work. Mailbox metadataDocumentsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
Microsoft (Outlook and SharePoint connectors) | Customer-initiated connector for ambient learning (Outlook, SharePoint). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator (or, for Outlook, the individual worker) authorises, to read the mailbox items or SharePoint documents that connection is scoped to so they can be matched to learning in the flow of work. Mailbox metadataDocumentsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
Zendesk (support-ticket connector) | Customer-initiated connector for ambient learning (Zendesk). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the support tickets that connection is scoped to so they can be matched to learning in the flow of work. Support ticketsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
Freshworks (Freshdesk support-ticket connector) | Customer-initiated connector for ambient learning (Freshdesk). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the support tickets that connection is scoped to so they can be matched to learning in the flow of work. Support ticketsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
ServiceNow (incident connector) | Customer-initiated connector for ambient learning (ServiceNow). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the incidents that connection is scoped to so they can be matched to learning in the flow of work. IncidentsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Not linked |
Atlassian (Jira and Confluence connectors) | Customer-initiated connector for ambient learning (Jira, Confluence). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the Jira issues or Confluence pages that connection is scoped to so they can be matched to learning in the flow of work. IssuesDocumentsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
GitHub (code connector) | Customer-initiated connector for ambient learning (GitHub). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the repository activity that connection is scoped to so they can be matched to learning in the flow of work. Repository activityUser names | Per vendor; chosen and controlled by the customer. | Trust Page |
Notion (knowledge connector) | Customer-initiated connector for ambient learning (Notion). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the Notion pages that connection is scoped to so they can be matched to learning in the flow of work. DocumentsNames in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
HubSpot (CRM connector) | Customer-initiated connector for ambient learning (HubSpot). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the CRM records that connection is scoped to so they can be matched to learning in the flow of work. CRM recordsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
Salesforce (CRM connector) | Customer-initiated connector for ambient learning (Salesforce). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the CRM records that connection is scoped to so they can be matched to learning in the flow of work. CRM recordsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
Zoho (Zoho CRM connector) | Customer-initiated connector for ambient learning (Zoho CRM). Not engaged by us on a customer’s behalf; listed for transparency. | Requests made with the OAuth or API credentials an organisation administrator authorises, to read the CRM records that connection is scoped to so they can be matched to learning in the flow of work. CRM recordsNames and email addresses in those items | Per vendor; chosen and controlled by the customer. | Trust Page |
Meta (WhatsApp Business Platform; only where the WhatsApp and SMS add-on is enabled) | Delivering learner messages over WhatsApp and SMS. | The recipient phone number and the text of the learner message for organisations that enable the WhatsApp and SMS add-on, when the platform has configured Meta as the WhatsApp provider; inbound replies and opt-outs (STOP) are received back by webhook. Phone numbersMessage contentDelivery and opt-out status | Per provider. | Trust Page |
Twilio (WhatsApp and SMS; only where the WhatsApp and SMS add-on is enabled) | Delivering learner messages over WhatsApp and SMS. | The recipient phone number and the text of the learner message for organisations that enable the WhatsApp and SMS add-on, when the platform has configured Twilio as the WhatsApp or SMS provider; inbound replies and opt-outs (STOP) are received back by webhook. Phone numbersMessage contentDelivery and opt-out status | Per provider. | Trust Page |
MSG91 (SMS; only where the WhatsApp and SMS add-on is enabled) | Delivering learner messages over WhatsApp and SMS. | The recipient phone number and the text of the learner message for organisations that enable the WhatsApp and SMS add-on, when the platform has configured MSG91 as the SMS provider. Phone numbersMessage contentDelivery and opt-out status | Per provider. | Trust Page |
CAIQ-Lite Consensus Assessment Summary
20-point Consensus Assessments Initiative Questionnaire (CAIQ-Lite) accelerating enterprise vendor security evaluation.
Architecture & Multi-Tenancy(2 questions)
How is customer data isolated in your multi-tenant environment?
Isolation is strictly enforced at the database kernel layer using PostgreSQL Row-Level Security (AS RESTRICTIVE tenant_boundary policies on every business table). Isolation does not rely solely on application-level filtering.
Are tenant databases logically or physically separated?
Personal Academy utilizes a shared-schema, logically separated database architecture secured by PostgreSQL RLS. Dedicated database instances are available for bespoke enterprise deployments.
Identity & Access Management(4 questions)
Does the platform support SAML 2.0 and OIDC Single Sign-On?
Yes. SAML 2.0 and OIDC federated authentication are fully supported for Okta, Microsoft Entra ID, Google Workspace, Ping Identity, and JumpCloud, included across all paid tiers at zero surcharge.
Is automated user lifecycle provisioning supported via SCIM 2.0?
Yes. Standard SCIM 2.0 endpoints (/api/scim/v2/Users and /Groups) support automated user creation, attribute updates, role mappings, and instantaneous deprovisioning.
Is Multi-Factor Authentication (MFA) supported and enforceable?
Yes. MFA (TOTP RFC 6238 and WebAuthn) is available to all users and can be strictly enforced tenant-wide by organization administrators.
How are privileged support and administrative sessions governed?
Platform operators do not hold persistent access to customer tenant data. Break-glass support access requires explicit justification, auto-expires after a time-boxed window, and is fully attributed in audit logs.
Cryptography & Encryption(3 questions)
What cryptographic standards protect data in transit?
All web traffic enforces TLS 1.3 (TLS 1.2 minimum) and Strict Transport Security (HSTS max-age 63,072,000 seconds with subdomains and preload). Deprecated ciphers are blocked.
What cryptographic standards protect data at rest?
Database volumes, disk snapshots, and cloud object stores are encrypted using hardware AES-256. Highly sensitive application secrets use envelope AES-256-GCM encryption.
Does Personal Academy support Customer Managed Encryption Keys (CMEK)?
Not for underlying database disk blocks. However, enterprise Bring Your Own Key (BYOK) is fully implemented for all AI model inference and external credentials.
Application Security & Sandboxing(3 questions)
How are interactive third-party SCORM/HTML packages isolated?
SCORM packages execute inside an opaque-origin iframe (sandbox="allow-scripts allow-forms", omitting allow-same-origin) backed by HTTP CSP sandbox headers and restricted PII access.
How does the application protect against Cross-Site Scripting (XSS)?
Content-Security-Policy enforces dynamic, per-request cryptographic nonces with strict-dynamic script validation, DOMPurify HTML sanitization, and output encoding across all templates.
How does the application prevent SQL Injection vulnerabilities?
All database queries execute via parameterized statements and Supabase client abstraction layers. Dynamic string interpolation in SQL statements is strictly prohibited.
Artificial Intelligence Governance(2 questions)
Is customer content or learner interaction data used to train AI models?
No. Personal Academy contractually and technically excludes customer prompts, training documents, and evaluations from foundation model training and retains zero data for fine-tuning.
Can an organization completely disable AI functionality?
Yes. Administrators can toggle AI features off globally or selectively per module. Toggles are verified on every incoming request at the database layer.
Vulnerability Management(2 questions)
What automated security testing is integrated into the CI/CD pipeline?
Every GitHub commit and pull request runs automated dependency scanning (Dependabot), semantic vulnerability analysis (CodeQL), and static analysis linting.
What is the published Vulnerability Disclosure policy and response SLA?
Vulnerabilities reported to our security team are acknowledged within 24 hours on business days under clear safe harbor protections for good-faith researchers.
Audit & Compliance Logging(1 questions)
What audit logging capabilities exist for security monitoring?
Security-relevant events (authentication, privilege escalation, role changes, exports, deletions) are recorded in an append-only, immutable audit log with actor, timestamp, IP, and state deltas.
Incident Response & Breach Notice(1 questions)
What is the notification SLA in the event of a confirmed personal data breach?
Personal Academy notifies affected enterprise customers without undue delay and strictly within 72 hours of becoming aware of a confirmed personal data breach.
Business Continuity & Disaster Recovery(1 questions)
What are your database backup and disaster recovery mechanisms?
Continuous automated Point-in-Time Recovery (PITR) and daily automated snapshots are managed via our enterprise database provider across multi-AZ redundant storage.
Certifications & Third-Party Audits(1 questions)
What is the current third-party audit and certification status?
Controls operate in alignment with SOC 2 Type II and ISO 27001 standards. Personal Academy is in pre-audit operational maturity, with formal observation windows scheduled on our compliance roadmap.
Data handling
Where data lives
All application data (accounts, course content, learner progress, files, audit events) is held in the managed Postgres, storage and auth services described under Sub-processors above. There is no separate customer-data store outside of that.
Retention defaults
Audit log retention
Configurable per organisation, from 90 days up to 10 years (3,650 days); the platform default is 730 days. Events older than the configured window are pruned nightly.
Learner record retention after deactivation
Configurable per organisation, from 30 days up to 10 years (3,650 days); the platform default is 365 days. Progress and quiz responses of a deactivated person are pseudonymised once the window elapses.
Deletion
Deletion is self-service: a signed-in person can request erasure of their own data, which is applied across every organisation they belong to and retires their sign-in account. Data is erased within 30 days of the request; backups expire on our database provider’s schedule. There is no manual ticket-and-wait process for this today.
Enterprise Security & Compliance Packet Access
Enterprise procurement and InfoSec teams can request our complete, NDA-backed security verification packet to expedite third-party vendor review.
Available under Mutual NDA
- Third-Party Vulnerability Assessment & Penetration Testing (VAPT) Executive Summary
- SOC 2 Type II Readiness & Complementary User Entity Controls (CUEC) Evidence Packet
- Pre-executed Standard Data Processing Addendum (GDPR Art. 28 / EU Standard Contractual Clauses)
- Completed CAIQ-Lite, HECVAT, and SIG-Core Enterprise Questionnaires
- Business Continuity & Disaster Recovery Exercise Summary
Direct Verification Desk
Requests must originate from a verified corporate or institutional email domain (@company.com). Webmail addresses are refused.
Questions about this page or a compliance request not answered here? Email privacy@personalacademy.app or call/WhatsApp +91 87 5678 7444 (WhatsApp, Mon–Fri, 9:30 AM – 6:30 PM IST).