Trust
Security, stated factually.
A learning platform that issues credentials must protect both learners and the meaning of the evidence. Here is what we do — and what we deliberately do not claim.
Controls in production
Each control below is implemented in the product and covered by automated tests.
Authentication
Password credentials are bcrypt-hashed; sessions use signed JWTs with expiry and refresh. Login and registration are rate-limited against brute force and enumeration.
Server-side authorization
Every sensitive operation is authorized on the server — role checks for admin functions, ownership checks on learner data, and membership checks on organization data. Interface hiding is never the security boundary.
Tenant isolation
Learner and organization data is partition-isolated in the data layer, and organization operations re-verify membership inside the target tenant's partition on every request. Cross-tenant denial is pinned by an adversarial test suite.
Signed credentials
Credentials are dual-signed (HMAC-SHA256 + Ed25519) with published verification keys and an offline verification bundle. Evidence is content-addressed and immutable; lifecycle changes are audit-logged and publicly visible.
Grade and completion immutability
No API endpoint exists to mutate grades or completion outside the deterministic mastery flow. Mastery evidence is written transactionally and append-only.
Upload scanning
Capstone uploads are validated (type and size), quarantined, malware-scanned, and only promoted on a cryptographically signed scanner callback with replay protection. Clean evidence is immutable.
AI guardrails
Model output passes managed content guardrails and JSON-schema validation before persistence — failing closed in production. Learner input is screened for prompt-injection patterns; web content is sanitized before grounding.
Cost governance
Per-learner daily AI budgets, per-course caps, and per-API-key spend limits are enforced with explicit 429 responses.
Data rights
Export your data, schedule account deletion, and request correction — implemented in the product, not just the policy. Consent is recorded at signup.
Honest limitations
Trust requires saying what is not true yet.
Not an identity service
Credentials prove account-holder mastery. We do not verify real-world identity or proctor exams, and every credential states this boundary.
No MFA or SSO yet
Multi-factor authentication and enterprise SSO/SCIM are roadmap items. We do not advertise them until they exist and are tested.
Internal assessment, not certification
Our security posture is validated by internal engineering assessment and automated tests. It is not an independent penetration test, SOC 2, ISO 27001, or any regulatory certification — and we will not imply otherwise.
Responsible disclosure
Found a vulnerability? Tell us before telling the world.
Report security issues through the contact form with the subject “Security disclosure” — it lands in an admin-visible queue with a reference ID. We ask for reasonable time to remediate before public disclosure.