Security

Last updated: 14 October 2026

How we protect credentials and personal information:

Every credential is signed with Ed25519 (Open Badges 3.0 / W3C Verifiable Credentials). Our public key is published at /.well-known/jwks.json.
HTTPS only (HSTS), strict Content Security Policy, frame protection, and embeds allowed only on LMS hosts approved by the platform administrator.
Passwordless sign-in with single-use 6-digit email codes, rate limits, lock-outs that back off, session timeouts, and emails about new admin devices.
Uploads are checked by file signature and re-encoded, and their metadata is stripped. SVG uploads are not accepted.
Credential IDs are random and carry a checksum, so they cannot be guessed or listed.
Audit log of issuing, revocation and design changes. Encrypted nightly backups.