This article answers common security, data protection, compliance, authentication, and AI-related questions for Coassemble Embed partners.

This article answers common security, data protection, compliance, authentication, and AI-related questions for **Coassemble Embed partners**.

## Data storage, regions, and encryption

### Where is data stored and processed?

By default, all customer data is stored and processed on **US-based infrastructure** (currently **Oregon, USA**). This includes:

* Course content

* Uploaded documents

* AI processing

### Can you guarantee data is processed in a specific region?

Yes, on the **Controlled Release server** *(previously referred to as Enterprise)* with **region locking** enabled.

* The **Standard Release server** *(previously referred to as Production)* does not currently offer this guarantee.

* **Region-Locked Server** options are available for **UK** and **EU**.

For more detail on server options, see **Server architecture** below.

### What encryption standards are used?

* **Data at rest:** Encrypted using **AES-256**

* **Data in transit:** Encrypted using **TLS 1.2**

* **Database encryption:** Encrypted at rest, with encryption keys managed by our hosting provider

## Environment segregation

### Are different environments segregated?

Yes. We use separate environments and separate databases for **production** and **testing**.

## Server architecture

### What server options are available?

Your server environment is chosen upfront as part of partnership setup. Configuration **cannot be changed after sign-up** without starting a new account.

Available options:

* **Standard Release server** *(previously Production)*: Shared environment that receives platform updates immediately on each release.

* **Controlled Release server** *(previously Enterprise)*: Shared environment that receives platform updates **two weeks after** the Standard Release server, giving customers extra preparation time.

* **Region-Locked Server**: Data is processed and stored within a specified region (**UK** or **EU**) for partners with data residency or compliance requirements.

* **Dedicated server**: Private, single-tenant environment. Can optionally be region-locked.

* **Self-hosting**: Available for partners with specific deployment requirements. Subject to commercial approval.

## Authentication and cookies (Embed Headless)

### Does the Embed (Headless) experience use cookies?

No. The **Embed (Headless)** experience is designed to work reliably inside iframes and is **cookie-less by design**. This explicitly avoids issues caused by **third-party cookie blocking** in embedded contexts (for example, in Safari/Chrome when an iframe is treated as a third party).

### Is each iframe load stateless?

The embed flow does not rely on a cookie-based session on Coassemble’s domain. Authentication is handled using a short-lived token (JWT) rather than cookies.

### How does authentication work for Embed (Headless)?

1. When the embeddable mounts, it **holds a JWT in memory**.
2. The embeddable uses that JWT for **each request** made to Coassemble’s server.
3. The JWT has a **3-hour expiry**.
4. A **refresh mechanism** is used to maintain continuity when the token expires.

### Does Coassemble use cookies anywhere?

Yes. Coassemble **does use cookies for regular (non-embed) login** experiences outside the Headless embed flow.

### What should partners communicate to customers?

If you’re embedding Coassemble in an iframe and need to minimise reliance on browser cookies, use the **Embed (Headless)** approach. For security/privacy documentation, it’s helpful to note that the embed flow does not depend on third-party cookies, while the standard login flow may set cookies.

## Access controls and logging

### What internal access controls are in place?

We follow an internal **Access Control Policy**, which can be provided upon request. Only authorised engineers have administrative access to production systems.

### Are audit logs maintained?

Yes. API calls and data access are logged across our systems.

## Compliance, legal, and documentation

### What certifications do you hold?

We hold a **SOC 2 Type 2** certification. Documentation is available via the Coassemble Trust Centre:

* <https://trust.coassemble.com/>

### What certifications does your hosting provider hold?

Our hosting infrastructure (via **Render**) sits on providers that maintain **SOC 2 Type 2** and **ISO 27001** certifications.

### Are you GDPR compliant?

Yes, we comply with **GDPR** requirements.

### Do you have a Data Processing Agreement (DPA)?

Yes. Our standard **DPA** is available and includes provisions covering data processing for **AI-driven features**.

### Can you provide audit reports or security assessments?

Yes, on request.

## Data retention, deletion, and opt-outs

### How long is customer-uploaded data retained?

Indefinitely by default, unless deletion is requested.

### How can partners delete data?

Using the Embed API, you can delete courses via the available endpoint. Any UI to initiate deletion would need to be built into your integration.

### How do you handle opt-out requests?

Opt-out processes are typically implemented on the partner side. We provide an API endpoint for course deletion to support these workflows.

## Backups, incident response, and monitoring

### What backup procedures are in place?

We support **point-in-time recovery**, allowing us to restore data to any point within the last **7 days**.

### What is your incident response plan?

We maintain an **Incident Response Plan** and a **Business Continuity and Disaster Recovery Plan** to respond to data-related incidents. These can be provided upon request.

### How do you detect security and availability issues?

We use:

* **Vanta** for continuous monitoring of data security and privacy controls

* **BetterStack** for real-time system and model availability monitoring

* **Segment** to detect unusual or unexpected usage patterns

## Privacy and PII

### Is personally identifiable information (PII) required by your system?

The Embed API integration does not require partners to pass any PII to identify users. We recommend Embed partners only share **anonymous identifiers** with Coassemble.

### What types of data are collected when documents are uploaded?

Uploaded documents are converted into a format suitable for processing by the LLM. Only document content (not PII) is sent to the LLM for processing.

When using features such as **Transform a document**, the uploaded file is securely stored in object storage.

### Where is your privacy policy?

* <https://coassemble.com/privacy-policy>

## AI processing

### Which AI providers and models do you use?

Coassemble integrates directly with **Google’s AI services**:

* **Gemini Flash** for text generation (course generation, document transformation, text refinement, translation)

* **Gemini 2.5 Flash Image** for AI-generated images

* **Chirp** for AI narration voices

### How is customer data used in AI training?

Customer content, prompts, and uploaded documents are **never** used to train the underlying models.

### Who owns AI-generated course content?

The customer retains **full ownership** of all content created in Coassemble, whether AI-generated or manually authored.

### Are there token or file size limits for uploads?

There are no strict token limits. Our primary guidance is pedagogical, and we recommend keeping courses under **25 screens**.

Large documents (100+ pages) can be uploaded, but the resulting content will be heavily summarised. The models we use support a **1 million-token** context window.

### How long is model context retained?

Context required for course generation is stored long-term in our database.

### What guardrails exist against AI hallucinations?

Our system includes guardrails designed to keep generated content aligned with training and learning objectives.

All LLMs remain susceptible to hallucinations, so full factual accuracy cannot be guaranteed. AI generation is intended to get creators **80–90%** of the way to a complete course, with a human review pass recommended to finalise.

### What's the failover strategy if an AI provider has issues?

We monitor model availability via BetterStack and use operational controls to maintain reliability.

In some configurations, Coassemble may use routing infrastructure (such as **OpenRouter**) to improve availability and manage failover across providers/models. See <https://openrouter.ai/docs/features/uptime-optimization> for more detail.

### What happens if you change AI providers?

All customers are notified in advance. Partners on the **Controlled Release server** *(previously referred to as Enterprise)* receive an additional **2 to 4 weeks** notice.

## Subprocessors and infrastructure

### Where are your subprocessors located?

Our subprocessor list is available via the Coassemble Trust Centre:

* <https://trust.coassemble.com/>

### Do you vet your subprocessors?

Yes. We review vendor documentation and rely on published certifications and security assurances.

### Who hosts the underlying infrastructure?

We use **Render** as our hosting provider. Render handles physical security, and the underlying infrastructure providers maintain **SOC 2 Type 2** and **ISO 27001** certifications.

### How are denial-of-service attacks handled?

We rely on Render’s built-in protections, and our infrastructure auto-scales to absorb high-load or DOS-style traffic.

## Security testing

### Do you conduct penetration testing?

Yes. We conduct an annual penetration test covering the platform broadly.

## Third-party providers

### What happens if a third-party AI provider experiences a breach?

We notify customers following our incident response plan and adjust provider usage as needed.


Coassemble Embed Partner Security, Data Protection & AI FAQ

Resources specifically for Embed (previously referred to as Headless course creation). These are resources that previously lived on the Headless Resources Hub.

Default usage caps for clients

Managing tenant caps

Accessibility guide

AI and Data Security for Coassemble Embed Partners

Coassemble vs. Articulate: Feature comparison guide for course authoring teams

Coassemble is WCAG 2.2 Level AA Conformant

Competitor analysis

Designing effective microlearning courses

How to access and interpret the Headless usage report

How to handle competitor objections when positioning your Embed solution

Guide to pricing models for Coassemble Embed and key competitor benchmarks

Sales enablement guide: Driving user adoption

Customer testimonials for Coassemble Embed course creation (sales enablement)

Our mission: Barrier-free knowledge transfer (partner-friendly positioning language)

Getting started guide

How to communicate Coassemble feature releases to your customers 

How to migrate courses from other authoring tools into Coassemble Embed

Guide to releases

Curate

AI Create

Customize

Learner experience

Embed Partners

Release notes

General

What is Coassemble?

Coassemble terminology explained

Accessing the login page

Getting to know your Coassemble workspace

Build the business case for Coassemble

Getting started: Common questions

How do I sign up for a Coassemble account?

What file types can I transform into a course?

What is a screen?

What tone should I select?

What is a collection?

Can I use Coassemble as an LMS?

How to log in to your account

Getting started

Connecting to Google Drive or OneDrive

Convert a presentation into an online course

Your knowledge

Usage limits

Identified Recipients and Anonymous Recipients

Logging in with Microsoft

Folders

Creators

Transfer ownership of your workspace

Configuring your email preferences

Common questions: Workspaces

How to delete a creator

Managing account, workspace, and billing settings

Organizing courses with folders

Your workspace & settings

How to upload custom fonts in Coassemble

How to save a legacy course theme

Brand kit: Saving pre-existing themes

How to apply Brand voice when generating courses

Brand voice

Asset library

Managing logos

How to create and configure themes

Managing and defaulting themes

Using the Brand kit

Brand Kit: A complete guide

How to edit video details

Brand kit

AI image generation

Generate a screen with AI

Refine with AI

Difference between transforming a document and converting a presentation

Coassemble's AI

Screens

Creating courses from scratch

Deleting courses

Duplicating courses

Enforce completion of videos

Generate a course with AI

The Finish screen

The Quiz screen

Transforming a document to a course

Translations

Images

Upload your videos to your course

Which screen should I use?

How do I create a course?

Common questions: Course creation

How to Upload Videos to Your Course

Narrating translations

Narration

Publishing

Loom integration

How to preview and review a course

Customizing course appearance with Themes

Managing and editing your course

Guide to AI Narration Tokens in Coassemble

Create & customize

Sharing course links & invitations

Collections: create, customize, share, and track learning paths

How to import a course from a template link

How to share your courses

Sharing courses with Slack

SCORM packages and translations

Exporting courses as SCORM

Common questions: Sharing

Template links

Email invitations

How to Add Your Coassemble Courses to Another Platform

How Coassemble tracks unique anonymous users

Sharing

How to filter Course insights by date range

Course insights

Link Insights

SCORM usage

Common Questions: Tracking Learners, Reporting, and Limits in Coassemble

Detailed Quiz results

Sentiment

Analyzing course-level Insights

Analyzing Collection-level Insights

Tracking content performance with Insights

Insights

Flow

Pulse

Embed Core

Embed Automate

Embed Partner

Overage, bands, and rates

Payments, billing, and subscriptions

Plans and advanced features

Explore best practices for sharing your knowledge.

Accessibility

Assessment: Best practice for quizzes

Best practices

SCORM files not loading

SCORM session errors on Apple devices

Why isn't my Embed screen working?

Common questions: Troubleshooting

What do I do if there is a bug?

Requesting a password reset link

Setting a new password

How to change or reset your password

Troubleshooting

SOC 2 compliance

Coassemble's approach to AI

AI & data security

Data security & AI

API keys

Passing identity (and tenant context) in embedded sessions

Notion

YouTube

Hubspot

Arcade

Vimeo

Unsplash

360Learning

aNewSpring

Docebo

Embed and Stripe: How to Sell Access Using Your Own Checkout and Coassemble Embed