Security and trust
Each organisation's data stays with that organisation.
This page describes the controls built into the platform design and the controls still planned. We would rather be precise than impressive.
Current status
Built into the platform design
Controls that shape how the platform works.
These principles are part of the platform architecture and apply to every organisation.
- Built into the design
Tenant isolation by design
Every organisation-owned record belongs to exactly one tenant, and every data request is scoped to the signed-in user's tenant and role on the server.
- Built into the design
Role-based access and least privilege
Platform operator permissions are separate from organisation permissions. Each role sees only what it needs.
- Built into the design
Controlled support access
Support staff cannot browse customer learning data by default. Access requires a reason, a scope and organisation approval, and it expires.
- Built into the design
Audit logging of sensitive actions
Tenant changes, role changes, subscription changes, data exports, record revocations and support access are recorded.
- Built into the design
Minimal public verification
The public certificate check shows only the reference, status, programme, issuer, issue date and an abbreviated name.
- Built into the design
Protected files
Course resources, submissions and exports are designed to be served only after a permission check, never from guessable public links.
Planned / in progress
Work that is not finished yet.
These items are planned or in progress. They are not available today and have no committed date.
- Planned
Single sign-on (SSO)
Integration with organisational identity providers.
- Planned
Independent security testing
External penetration testing before general availability.
- Planned
Data residency options
Hosting region choices to be confirmed with the infrastructure decision.
- Planned
Published data-processing terms
A data processing agreement, pending legal review.
- Planned
Status page and incident communication
A public status page and incident notification process.
Questions and reports
Talk to us about security.
If you have security questions for a procurement review, or need to report a potential vulnerability, contact us. Please do not include sensitive data in your first message.
Security and procurement questions: mezeadichie@experviatechnologies.com
Report a potential issue: mezeadichie@experviatechnologies.com
A dedicated security contact and disclosure policy are planned.
Review the platform with your security team.
See the platform working on realistic demo data, and talk to us about your programmes, learners and timelines.