Security Controls & Posture
Last updated: 26 September 2026 · Technical inventory of operational security controls across database partitioning, identity federation, cryptographic secrecy, and application runtimes.
Personal Academy enforces database-enforced organisation isolation with PostgreSQL Row Level Security (RLS) restrictive boundaries on every tenant table. All data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Third-party SCORM packages execute in an opaque-origin sandbox without access to host sessions or cookies. GitHub dependency vulnerability alerts are on for the repository; automated code scanning (CodeQL) is run on demand before a release, not on every change. Not currently SOC 2 certified or ISO 27001 certified. Controls are aligned with those frameworks and not yet independently audited.
Four Foundational Security Pillars
1. Multi-Tenant Data Isolation
- •Kernel-Enforced RLS: Every business table incorporates an explicit tenant identifier governed by an
AS RESTRICTIVEdatabase boundary policy. - •Fail-Safe Engine Evaluation: Isolation does not rely on ORM queries appending
WHERE tenant_id = ?. The database engine rejects unauthorized reads or writes. - •Real-Time Entitlement Checks: Tenant permissions and module licenses are checked dynamically on every request at the database layer.
2. Identity & Access Governance
- •Enterprise Federation (SAML 2.0 & OIDC): Works with identity providers that implement SAML 2.0 or OpenID Connect; included on every paid plan.
- •SCIM 2.0 Real-Time Deprovisioning: User offboarding in the corporate directory revokes active sessions and bearer tokens instantly.
- •Zero SSO Tax: SAML, OIDC, and SCIM 2.0 are standard across all commercial plans at zero surcharge.
3. Enterprise AI Safety
- •Auditable Central Gateway: All AI interactions pass through a single gateway that verifies tenant quota and applies mandatory safety boundaries.
- •Zero Model Training: Commercial enterprise agreements strictly exclude customer prompts, materials, and evaluations from public training.
- •Bring Your Own Key (BYOK): Direct routing to your private Azure OpenAI, Anthropic, or OpenAI tenancy with envelope encryption.
4. Content Sandboxing
- •Opaque-Origin Iframe Execution: SCORM packages execute with
sandbox="allow-scripts allow-forms", strictly omittingallow-same-origin. - •CSP Header-Level Enforcement: Content routes enforce CSP sandbox directives preventing direct-URL browser breakouts.
- •Zero Learner Identity Exposure: SCORM runtime calls to
cmi.learner_idorcmi.learner_namereturn error 403 (Not Initialized) by design.
Cryptographic & Secret Protection Standards
Data in Transit
TLS 1.3 enforced across all endpoints (with TLS 1.2 minimum fallback). HSTS preloaded with 2-year max-age. Cryptographic nonced Content-Security-Policy (CSP Level 3) on every response.
Data at Rest
Database clusters, automated daily snapshots, and cloud storage buckets are encrypted using hardware AES-256 provided by managed PostgreSQL infrastructure.
Application Envelope Encryption
Sensitive credentials (AI provider keys, OAuth client secrets, LTI signing keys) use application-layer AES-256-GCM envelope encryption prior to database ingestion. Cleartext secrets are never stored.
Compliance & Framework Alignment Matrix
How Personal Academy technical architecture and operational safeguards align with major international frameworks.
| Standard / Framework | Scope & Relevance | Technical & Operational Controls | Status |
|---|---|---|---|
| SOC 2 Type II (Common Criteria) | Security, Confidentiality, and Availability across SaaS operations. | Continuous RLS isolation enforcement, automated CI/CD security scanning, least-privilege administrative access, append-only immutable audit logging, and automated daily backups. | Controls Aligned (Audit observation scheduled) |
| ISO/IEC 27001:2022 (ISMS) | Information Security Management System controls (A.5 through A.8). | Documented security policies, annual vendor risk assessments, structured incident management runbooks, cryptographic key governance, and formal change control. | ISMS Framework Aligned |
| GDPR & UK GDPR (EU 2016/679) | Data protection, international data transfers, and data subject rights. | Standard pre-signed DPA incorporating EU SCCs, self-service user data export (Art. 15/20) and complete account erasure (Art. 17), 72-hour breach notice procedure, and strict 30-day sub-processor change notice. | Fully GDPR-Ready |
| EU AI Act (Regulation 2024/1689) | AI governance, transparency, and high-risk educational system avoidance. | Public AI Feature Register, mandatory transparency disclosures for conversational AI, non-consequential advisory scoring, human review override requirements (ai.decision.review), and non-training vendor terms. | Deployer Compliance Ready |
| OWASP Top 10 & ASVS L2 | Web application vulnerability hardening and threat resistance. | Edge Middleware parameterized queries, nonced CSP Level 3, automated dependency vulnerability alerts (CodeQL, Dependabot), and strict input validation via runtime schema validation (Zod). | Hardened Baseline |
Operational Controls Inventory
Tenant isolation by restrictive row-level security
ActiveEvery business table carries a tenant_id column and an AS RESTRICTIVE tenant_boundary policy, enforced by Postgres itself on every query — not by application code remembering to filter.
source: supabase/migrations (tenant_boundary policies, e.g. 20260909000042_tenant_scope.sql); npm run db:test
Permission-based authorisation
ActiveAccess decisions go through has_permission(key), checked against a granular permission catalogue and each organisation’s own role definitions — both in RLS and in route handlers. Application code never branches on a role name.
source: supabase/migrations/20260909000041_rbac_foundation.sql (has_permission); lib/admin-auth.ts
Append-only audit log
ActivePrivileged actions and sign-in events are recorded in audit_events with actor, tenant, before/after state and a timestamp. The log is append-only for every API role: rows cannot be updated or deleted through the application or its API.
source: supabase/migrations/20260909000049_audit_and_ai_quota.sql
Module entitlements read per request
ActiveWhat an organisation is entitled to is looked up on every request, never stamped into the session token. A downgrade or an entitlement change takes effect immediately instead of waiting up to an hour for a token to expire.
source: supabase/migrations/20260910000074_module_entitlements.sql through 20260910000077; lib/entitlements.ts
Self-service data export and erasure
ActiveAny signed-in person can download a complete export of their own data (GDPR Art. 15/20) or request erasure across every organisation they belong to (GDPR Art. 17), typing their email to confirm.
source: app/api/account/export/route.ts; app/api/account/erase/route.ts
Time-boxed, attributed break-glass access
ActiveWhen platform staff need temporary access to an organisation’s data for support, the session has an explicit expiry, a required reason, and is tied to the staff member’s own identity — not a standing administrative account.
source: supabase/migrations/20260909000041_rbac_foundation.sql (platform_access_sessions, expires_at); supabase/migrations/20260909000051_breakglass_precedence.sql
Responsible disclosure
We welcome good-faith security research. If you believe you have found a vulnerability in Personal Academy, please report it privately so we can fix it before it is made public.
How to report
- Email support@personalacademy.app with a description, the affected URL or API, and steps to reproduce.
- Do not include other people’s personal data in your report; describe it instead.
- We acknowledge every report within 24 hours on business days and keep you informed until it is resolved.
Contact: support@personalacademy.app (a dedicated security mailbox is not set up yet; this is our support address). Machine-readable: /.well-known/security.txt. We acknowledge reports within 24 hours.
Scope
- In scope: personalacademy.app and its subdomains, and the public API.
- Out of scope: denial-of-service testing, social engineering, physical attacks, and third-party services (see the sub-processor list; report those to the provider).
Safe harbour
If you act in good faith — you stay within scope, avoid accessing or changing data that is not yours, stop when you reach personal data, and give us reasonable time to respond before disclosing — we will not take or support legal action against you for your research.
Enterprise Security & Compliance Packet Access
Enterprise procurement and InfoSec teams can request our complete, NDA-backed security verification packet to expedite third-party vendor review.
Available under Mutual NDA
- Third-Party Vulnerability Assessment & Penetration Testing (VAPT) Executive Summary
- SOC 2 Type II Readiness & Complementary User Entity Controls (CUEC) Evidence Packet
- Pre-executed Standard Data Processing Addendum (GDPR Art. 28 / EU Standard Contractual Clauses)
- Completed CAIQ-Lite, HECVAT, and SIG-Core Enterprise Questionnaires
- Business Continuity & Disaster Recovery Exercise Summary
Direct Verification Desk
Requests must originate from a verified corporate or institutional email domain (@company.com). Webmail addresses are refused.