Security & privacy status
We minimize information collected and describe protections without promising that any service is breach-proof. This page is a factual implementation summary, not a certification or independent audit report.
Application protections
- Protected course content and student records require server-side identity and access checks. An individual course does not unlock other courses.
- State-changing student requests use same-origin checks; privacy endpoints are rate limited per signed-in account.
- Personalized pages and API responses use private, no-store caching. Browser policies limit referrer disclosure, embedded objects, framing and access to cameras, microphones and geolocation.
- The academy does not store account passwords or full card details. Paid enrollment uses hosted checkout when payment activation is complete.
- Cloud saving of learning text is optional and off by default. Students can export records, clear learning text, delete saved learning data and submit broader privacy requests.
- Payment webhook signatures and matching purchase details are checked before enrollment is granted. Automated checks cover access isolation, unpaid purchases and refund revocation.
- Media storage is private. The temporary production-upload endpoint is disabled.
Privacy, enrollment and payment records still contain personal information. An account identifier is not anonymous merely because it is not your name.
Validation and limits
The latest production-dependency audit reported no known advisories. Three advisories remain in development tooling and are tracked for follow-up. Automated integration checks cover privacy controls, identity isolation, bounded request bodies, media access, payment verification and refunds. These are point-in-time checks, not proof that every vulnerability has been found. Browser interaction checks were blocked by the preview connection.
Certification and assurance
Learnvoriq Academy has not obtained ISO/IEC 27001 certification or a SOC 1 or SOC 2 examination report. GDPR compliance has not been independently established. Infrastructure suppliers’ certifications do not certify the academy. We do not display certification badges or make compliance guarantees.
Account MFA enforcement, vendor agreements, hosting encryption and data residency, provider-wide recovery, incident-response exercises, independent penetration testing and legal applicability remain owner/vendor verification work. An encrypted live snapshot has been restored successfully into isolated SQLite; a production D1 restore and provider-wide failover remain unverified. No full browser or independent security audit has been completed by these code checks.
Report a concern
Use your signed-in privacy controls for an account-related review. Do not send passwords, card information or exploit data through course notes. A dedicated security-reporting contact still needs to be configured by the owner before paid launch.