Security
Where your data lives, who can reach it, and what we do about it. Written plainly rather than as a certification badge, because we do not have one yet and would rather say so.
What we hold
Account details, learning progress, project submissions and their assessments, and certificates. For learners enrolled by an institution, no email address.
How it is protected
- Encrypted in transit, on every connection.
- Encrypted at rest, in the database and in file storage.
- Project submissions sit in a private bucket that is not publicly reachable. A reviewer receives a signed link valid for one hour, generated when they open the submission.
- Access rules are enforced by the database itself, not only by the interface. A bug in a page cannot expose another learner’s records.
Who at Splari can see what
Reviewers see the work assigned to them. Institution administrators see their own cohorts. A small number of Splari staff hold operational access for support and billing, and every use of it is logged.
Sub-processors
We use managed services rather than running our own infrastructure, because the people who do this full time do it better than we would. Each is contractually limited to processing on our instruction. We publish the current list, and the region each operates in, in the data processing agreement we sign with institutions.
What we do not have yet
We are not SOC 2 or ISO 27001 certified. We are a small company and would rather tell you that than imply otherwise. If your procurement process requires a certification, we are not the right supplier today.
Single sign-on, exportable audit logs and data residency guarantees are not available yet either. If you need them, talk to us about timing before you commit.
Backups
The database is backed up daily and restores are tested, because an untested backup is not a backup.
Reporting something
If you find a vulnerability, email security@splari.com. We will acknowledge within two working days. We will not take legal action against anyone who reports a genuine issue in good faith and gives us a chance to fix it.