The LMS is hosted on AWS across multiple availability zones, with continuous database backups and point-in-time recovery. Each account's data is scoped to that account, traffic is encrypted in transit, and stored data is encrypted at rest. On your side, a Super Admin sets the security policy for the account — password complexity, multi-factor authentication, session timeout and IP allow-listing — and the activity log records administrative actions, including any session in which an admin views the portal as a named learner. For what a security review needs in writing — hosting and data-residency options, recovery objectives, current certification status, subprocessors, or a completed security questionnaire — ask your account manager; that material is shared by the security team, under NDA where required, rather than published here.
