Security & Data Handling
Security is a core requirement for a service that handles course content and learner data. This page describes the controls we use, the boundaries of our responsibility, and the certifications we do and do not hold.
Honest status. We are not currently SOC 2 or ISO/IEC 27001 certified. Our controls are designed with those frameworks in mind, and we will publish certifications here if and when they are completed. Do not rely on a certification that is not listed.
1. Infrastructure and architecture
SCORM Craft runs on Cloudflare Workers and Cloudflare Containers. Customer content and the application database are stored in Cloudflare R2 object storage, mounted into the container. The application uses a single container instance per deployment for consistency. Cloudflare provides TLS termination, network protection and global edge infrastructure. Course processing happens inside the container; the rebuilt package is generated from the uploaded assets and stored in R2.
2. Encryption and access
- TLS 1.2+ for data in transit between your browser and the service.
- Encryption at rest at the infrastructure provider (Cloudflare R2).
- Secrets (session keys, payment and storage credentials) are stored as encrypted Worker secrets, not in source code.
- Production access is limited to authorised personnel with a business need; administrative actions are logged by the platform.
- Session cookies are HttpOnly and SameSite=Lax; magic links are single-use and short-lived; login requests are rate-limited.
- Customer courses are separated by course ID and access checks; guest uploads are tied to a signed browser cookie.
3. Data minimisation and retention
We collect the account email, course content, branding, payment identifiers and technical logs needed to provide the service. We do not ask for passwords. We do not store full card numbers; payments are handled by Dodo Payments. Retention periods are described in the Privacy Policy. You can delete a course from the studio; deletion removes the course directory and its generated package from active storage, subject to the residual-copy rules described in the Privacy Policy.
4. Vendors and subprocessors
We use a small set of infrastructure and payment providers. Each is subject to contractual data-protection and security commitments. The current list, purposes and locations are at /legal/subprocessors.html. We review vendors before onboarding and when their services materially change.
5. Incident response
We monitor service health and errors and maintain an incident-response process. If we confirm a personal-data breach affecting Customer Content, we will notify the affected controller without undue delay and, where feasible, within 48 hours, with the information reasonably available. We will investigate, contain, remediate and cooperate with the controller’s notifications. Security reports can be sent to security@scormcraft.app. Please do not publicly disclose a suspected vulnerability before we have had a reasonable opportunity to investigate and fix it.
6. Availability and backups
We aim for high availability but do not offer a public SLA unless separately agreed. Cloudflare R2 is designed for durable object storage; we do not currently offer customer-controlled point-in-time backups or a separate backup export. You can download your generated SCORM package from the studio. We recommend keeping your original SCORM package and a copy of the downloaded output.
7. Customer responsibilities
- Keep your email inbox and magic links secure; use an organisational address you control.
- Upload only content you have the rights and notices to use, and only personal data you are authorised to process.
- Do not upload special-category data, children’s data or regulated high-risk data without appropriate safeguards and legal advice.
- Test the downloaded package in your LMS and on your target devices before delivering it to learners.
- Choose branding colors and content that meet your accessibility and legal requirements.
- Delete courses you no longer need and keep your own copy of the original package.
8. AI and data use
We do not use Customer Content to train generative AI models, and we do not sell it or use it for advertising. If we introduce an AI-assisted feature, we will describe the data used, the provider, the retention and the opt-in or opt-out in this page and the Privacy Policy before enabling it for customer content.
9. Certifications and audits
We do not currently hold SOC 2, ISO/IEC 27001, HIPAA or PCI DSS certification as a service provider. Dodo Payments handles card data under its own PCI DSS programme. We support customer security reviews through questionnaires and remote discussions; see the DPA for audit terms. Any future certification will be listed here with its scope and date.
10. Contact
Security contact: security@scormcraft.app. Privacy: privacy@scormcraft.app. Legal: legal@scormcraft.app.