Coassemble Embed Partner Security, Data Protection & AI FAQ
This article answers common security, data protection, compliance, authentication, and AI-related questions for Coassemble Embed partners.
Data storage, regions, and encryption
Where is data stored and processed?
By default, all customer data is stored and processed on US-based infrastructure (currently Oregon, USA). This includes:
-
Course content
-
Uploaded documents
-
AI processing
Can you guarantee data is processed in a specific region?
Yes, on the Controlled Release server (previously referred to as Enterprise) with region locking enabled.
-
The Standard Release server (previously referred to as Production) does not currently offer this guarantee.
-
Region-Locked Server options are available for EU, US and APAC.
For more detail on server options, see Server architecture below.
What encryption standards are used?
-
Data at rest: Encrypted using AES-256
-
Data in transit: Encrypted using TLS 1.2
-
Database encryption: Encrypted at rest, with encryption keys managed by our hosting provider
Environment segregation
Are different environments segregated?
Yes. We use separate environments and separate databases for production and testing.
Server architecture
What server options are available?
Your server environment is chosen upfront as part of partnership setup. Configuration cannot be changed after sign-up without starting a new account.
Available options:
-
Standard Release server (previously Production): Shared environment that receives platform updates immediately on each release.
-
Controlled Release server (previously Enterprise): Shared environment that receives platform updates two weeks after the Standard Release server, giving customers extra preparation time.
-
Region-Locked Server: Data is processed and stored within a specified region (EU, US or APAC) for partners with data residency or compliance requirements.
-
Dedicated server: Private, single-tenant environment. Can optionally be region-locked.
-
Self-hosting: Available for partners with specific deployment requirements. Subject to commercial approval.
Authentication and cookies (Embed)
Does the Embed experience use cookies?
No. The Embed experience (previously referred to as Headless) is designed to work reliably inside iframes and is cookie-less by design. This explicitly avoids issues caused by third-party cookie blocking in embedded contexts (for example, in Safari/Chrome when an iframe is treated as a third party).
Is each iframe load stateless?
The embed flow does not rely on a cookie-based session on Coassemble's domain. Authentication is handled using a short-lived token (JWT) rather than cookies.
How does authentication work for Embed?
- When the embeddable mounts, it holds a JWT in memory.
- The embeddable uses that JWT for each request made to Coassemble's server.
- The JWT has a 3-hour expiry.
- A refresh mechanism is used to maintain continuity when the token expires.
Does Coassemble use cookies anywhere?
Yes. Coassemble does use cookies for regular (non-embed) login experiences outside the embed flow.
What should partners communicate to customers?
If you're embedding Coassemble in an iframe and need to minimise reliance on browser cookies, use the Embed approach. For security/privacy documentation, it's helpful to note that the embed flow does not depend on third-party cookies, while the standard login flow may set cookies.
Access controls and logging
What internal access controls are in place?
We follow an internal Access Control Policy, which can be provided upon request. Only authorised engineers have administrative access to production systems.
Are audit logs maintained?
Yes. API calls and data access are logged across our systems.
Compliance, legal, and documentation
What certifications do you hold?
We hold a SOC 2 Type 2 certification. Documentation is available via the Coassemble Trust Centre:
What certifications does your hosting provider hold?
Our hosting infrastructure (via Render) sits on providers that maintain SOC 2 Type 2 and ISO 27001 certifications.
Are you GDPR compliant?
Yes, we comply with GDPR requirements.
Do you have a Data Processing Agreement (DPA)?
Yes. Our standard DPA is available and includes provisions covering data processing for AI-driven features.
Can you provide audit reports or security assessments?
Yes, on request.
Data retention, deletion, and opt-outs
How long is customer-uploaded data retained?
Indefinitely by default, unless deletion is requested.
How can partners delete data?
Using the Embed API, you can delete courses via the available endpoint. Any UI to initiate deletion would need to be built into your integration.
How do you handle opt-out requests?
Opt-out processes are typically implemented on the partner side. We provide an API endpoint for course deletion to support these workflows.
Backups, incident response, and monitoring
What backup procedures are in place?
We support point-in-time recovery, allowing us to restore data to any point within the last 7 days.
What is your incident response plan?
We maintain an Incident Response Plan and a Business Continuity and Disaster Recovery Plan to respond to data-related incidents. These can be provided upon request.
How do you detect security and availability issues?
We use:
-
Vanta for continuous monitoring of data security and privacy controls
-
BetterStack for real-time system and model availability monitoring
-
Segment to detect unusual or unexpected usage patterns
Privacy and PII
Is personally identifiable information (PII) required by your system?
The Embed API integration does not require partners to pass any PII to identify users. We recommend Embed partners only share anonymous identifiers with Coassemble.
What types of data are collected when documents are uploaded?
Uploaded documents are converted into a format suitable for processing by the LLM. Only document content (not PII) is sent to the LLM for processing.
When using features such as Transform a document, the uploaded file is securely stored in object storage.
Where is your privacy policy?
AI processing
Which AI providers and models do you use?
Coassemble integrates directly with Google's AI services:
-
Gemini Flash for text generation (course generation, document transformation, text refinement, translation)
-
Gemini 2.5 Flash Image for AI-generated images
-
Chirp for AI narration voices
How is customer data used in AI training?
Customer content, prompts, and uploaded documents are never used to train the underlying models.
Who owns AI-generated course content?
The customer retains full ownership of all content created in Coassemble, whether AI-generated or manually authored.
Are there token or file size limits for uploads?
There are no strict token limits. Our primary guidance is pedagogical, and we recommend keeping courses under 25 screens.
Large documents (100+ pages) can be uploaded, but the resulting content will be heavily summarised. The models we use support a 1 million-token context window.
How long is model context retained?
Context required for course generation is stored long-term in our database.
What guardrails exist against AI hallucinations?
Our system includes guardrails designed to keep generated content aligned with training and learning objectives.
All LLMs remain susceptible to hallucinations, so full factual accuracy cannot be guaranteed. AI generation is intended to get creators 80–90% of the way to a complete course, with a human review pass recommended to finalise.
What's the failover strategy if an AI provider has issues?
We monitor model availability via BetterStack and use operational controls to maintain reliability.
In some configurations, Coassemble may use routing infrastructure (such as OpenRouter) to improve availability and manage failover across providers/models. See https://openrouter.ai/docs/features/uptime-optimization for more detail.
What happens if you change AI providers?
All customers are notified in advance. Partners on the Controlled Release server (previously referred to as Enterprise) receive an additional 2 to 4 weeks notice.
Subprocessors and infrastructure
Where are your subprocessors located?
Our subprocessor list is available via the Coassemble Trust Centre:
Do you vet your subprocessors?
Yes. We review vendor documentation and rely on published certifications and security assurances.
Who hosts the underlying infrastructure?
We use Render as our hosting provider. Render handles physical security, and the underlying infrastructure providers maintain SOC 2 Type 2 and ISO 27001 certifications.
How are denial-of-service attacks handled?
We rely on Render's built-in protections, and our infrastructure auto-scales to absorb high-load or DOS-style traffic.
Security testing
Do you conduct penetration testing?
Yes. We conduct an annual penetration test covering the platform broadly.
Third-party providers
What happens if a third-party AI provider experiences a breach?
We notify customers following our incident response plan and adjust provider usage as needed.