Your learners’ data, handled properly.
What we encrypt, how your own domain is defended, where your data is stored, and why none of it ever becomes training data — in plain language, with the legal detail linked.
Your brand at the front. Our defences behind it.
White-label usually means your domain is the weak point — a bare CNAME with none of the protection the main platform enjoys. That is not how this works.
A certificate for your domain
When you point your own domain at Learn 360, it is registered as a custom hostname and issued its own TLS certificate automatically. All you add is one CNAME record.
Bot defences on your domain
Your domain sits behind the same CDN as ours, which means your learners get the same bot filtering and rate limiting — not a weaker setup because the domain is yours.
Hardened at the application
Security headers including a Content-Security-Policy, a strict origin allowlist for cross-origin requests, and separate rate limits on sign-in attempts.
Your content and your learners are not training data.
We do not use customer or learner data to train artificial intelligence models. Not your courses, not your learners’ records, not their submissions. That commitment is written into our Privacy Policy, not just stated here — and it applies to every plan.
Read it in the Privacy PolicyThe protections that run by default.
None of this is a setting you have to find and switch on. It applies to every organisation, on every plan, including Free.
Encrypted in transit
Every connection runs over HTTPS/TLS — for your admins, your learners, and every tenant domain.
Encrypted at rest
Uploaded identity documents and stored third-party credentials are encrypted with AES-256-GCM before they reach storage.
Passwords are hashed
Passwords are stored as one-way hashes. Nobody here can read a learner’s password — only reset it.
Tenant isolation
Your courses, learners and records are isolated from every other organisation on the platform.
Role-based access
Owners, admins, managers and learners see only what their role permits, and you decide who holds which.
Audit trail
A per-organisation activity log records sign-ins, enrolments, completions and administrative changes.
Protected course files
Media and documents are served through short-lived signed links, not public URLs that can be passed around.
Patched for you
Security updates ship with the platform. There is no server for you to maintain and nothing to patch.
Stored in the US, transferred lawfully.
Where it is processed
Learn 360 is available worldwide. Your information may be processed or stored in the United States, and in other countries where we or our service providers operate.
Leaving the EEA or UK
Where personal information leaves the EEA, the UK or Switzerland, we rely on recognised safeguards — the European Commission’s Standard Contractual Clauses and the UK Addendum.
Who else touches it
A small number of sub-processors help run the platform. The current list is available on request, and we give advance notice before adding a new one so you can object.
You’re the controller. We’re the processor.
Your learners are your relationship. We process their data to run the platform for you, on your instructions, and nothing beyond them.
Aligned to ISO 27001 — not yet certified
We have implemented the controls ISO 27001 calls for: access control, encryption, logging, change management and incident response. We do not hold an accredited certificate, and we will not claim one. If your procurement needs the detail, ask and we will walk you through exactly what we do.
The rights we honour
Access, correction, deletion, portability, restriction and objection — for you and for your learners, whether the request comes through us or through you.
Processor terms, in writing
Our commitments are set out in the Terms: we act on documented instructions, keep staff under confidentiality, and assist you with data-subject requests.
If something goes wrong
If we become aware of a breach affecting your personal information, we notify affected users and the relevant authorities as required, without undue delay.
Controls you operate yourself.
Verify who gets in
Require learners to upload an office ID or document, and approve each one yourself before they can reach any content.
Stop password sharing
Single-device login keeps one learner account signed in on one device at a time.
Know about new devices
A sign-in from an unrecognised device triggers an alert email, so an unexpected login does not go unnoticed.
Take your data out
Export your organisation’s data whenever you want. Deleted accounts enter a 30-day recovery window before removal.
The documents, and a human to ask.
Buying for a regulated team? We will complete your security questionnaire, provide a data processing agreement, or send our current sub-processor list.
Email our teamThis page summarises our Privacy Policy, which is the binding version. If the two ever differ, the Privacy Policy governs.