Coassemble Embed Partner Security, Data Protection & AI FAQ
Security, data protection and AI: partner FAQ
The security, data protection, compliance, authentication and AI answers partners need for their own customer reviews.
This article answers the questions that come up most often when a partner's customer runs a security or procurement review.
Data storage, regions, and encryption
Where is data stored and processed?
By default, all customer data is stored and processed on US-based infrastructure (currently Oregon, USA). This includes:
- Course content
- Uploaded documents
- AI processing
Can you guarantee data is processed in a specific region?
Yes, on the Controlled Release server (previously referred to as Enterprise) with region locking enabled.
- The Standard Release server (previously referred to as Production) does not currently offer this guarantee.
- Region-locked server options are available for EU, US, APAC and UK.
For more detail on server options, see Server architecture below.
What encryption standards are used?
- Data at rest: encrypted using AES-256
- Data in transit: encrypted using TLS 1.2
- Database encryption: encrypted at rest, with encryption keys managed by our hosting provider
Environment segregation
Are different environments segregated?
Yes. We use separate environments and separate databases for production and testing.
Server architecture
What server options are available?
Your server environment is chosen upfront as part of partnership setup. Configuration cannot be changed after sign-up without starting a new account.
Available options:
- Standard Release server (previously Production): shared environment that receives platform updates immediately on each release.
- Controlled Release server (previously Enterprise): shared environment that receives platform updates after the Standard Release server, giving customers preparation time. The interval varies by release and is confirmed with you ahead of each one.
- Region-locked server: data is processed and stored within a specified region (EU, US, APAC or UK) for partners with data residency or compliance requirements.
- Dedicated server: private, single-tenant environment. Can optionally be region-locked.
- Self-hosting: available for partners with specific deployment requirements. Subject to commercial approval.
Authentication and cookies
Does the embedded experience use cookies?
No. The embedded experience is designed to work reliably inside iframes and is cookie-less by design. This explicitly avoids issues caused by third-party cookie blocking in embedded contexts, for example in Safari or Chrome when an iframe is treated as a third party.
Is each iframe load stateless?
The embed flow does not rely on a cookie-based session on Coassemble's domain. Authentication is handled using a short-lived token (JWT) rather than cookies.
How does authentication work?
- When the embeddable mounts, it holds a JWT in memory.
- The embeddable uses that JWT for each request made to Coassemble's server.
- The JWT has a 3-hour expiry.
- A refresh mechanism maintains continuity when the token expires.
Does Coassemble use cookies anywhere?
Yes. Coassemble does use cookies for regular login experiences outside the embed flow.
What should partners communicate to customers?
If you're embedding Coassemble in an iframe and need to minimise reliance on browser cookies, the embedded approach covers it. For security and privacy documentation, it's helpful to note that the embed flow does not depend on third-party cookies, while the standard login flow may set cookies.
Access controls and logging
What internal access controls are in place?
We follow an internal Access Control Policy, which can be provided on request. Only authorised engineers have administrative access to production systems.
Are audit logs maintained?
Yes. API calls and data access are logged across our systems.
Compliance, legal, and documentation
What certifications do you hold?
We hold SOC 2 Type 1 and Type 2 reports. Documentation is available via the Coassemble Trust Centre:
What certifications does your hosting provider hold?
Our hosting infrastructure (via Render) sits on providers that maintain SOC 2 Type 2 and ISO 27001 certifications.
Are you GDPR compliant?
Yes, we comply with GDPR requirements.
Do you have a Data Processing Agreement (DPA)?
Yes. Our standard DPA is available and includes provisions covering data processing for AI-driven features.
Can you provide audit reports or security assessments?
Yes, on request.
Is Coassemble accessible?
Courses are built to meet WCAG 2.2 Level AA. The Classic learner experience has an independent Statement of Conformance from Modality Co. The new builder's learner experience is built to the same standard, applying everything learned from that audit, and has not been independently verified at this stage.
SCORM packages hosted in Coassemble
Where is a hosted SCORM package stored?
A SCORM package brought into Coassemble is stored in the same object storage as other uploaded content, on the same infrastructure and under the same encryption and access controls described above. Region locking applies to it in the same way.
What data is captured when a learner takes a hosted SCORM course?
Completion and progress data is captured against the recipient in the same way as a Coassemble-authored course, so it appears in reporting and is available through the API. The package itself runs inside Coassemble rather than calling out to the tool that produced it.
Is package content sent to an AI model?
No. Hosting a SCORM package runs it as-is. Content is only sent to a model if you separately choose to convert the package into a Coassemble course.
Data retention, deletion, and opt-outs
How long is customer-uploaded data retained?
Indefinitely by default, unless deletion is requested.
How can partners delete data?
Using the API, you can delete courses via the available endpoint. Any UI to initiate deletion would need to be built into your integration.
How do you handle opt-out requests?
Opt-out processes are typically implemented on the partner side. We provide an API endpoint for course deletion to support these workflows.
Backups, incident response, and monitoring
What backup procedures are in place?
We support point-in-time recovery, allowing us to restore data to any point within the last 7 days.
What is your incident response plan?
We maintain an Incident Response Plan and a Business Continuity and Disaster Recovery Plan to respond to data-related incidents. These can be provided on request.
How do you detect security and availability issues?
We use:
- Vanta for continuous monitoring of data security and privacy controls
- BetterStack for real-time system and model availability monitoring
- Segment to detect unusual or unexpected usage patterns
Privacy and PII
Is personally identifiable information (PII) required by your system?
The API integration does not require partners to pass any PII to identify users. We recommend partners only share anonymous identifiers with Coassemble.
What types of data are collected when documents are uploaded?
Uploaded documents are converted into a format suitable for processing by the LLM. Only document content, not PII, is sent to the LLM for processing.
When using features such as transforming a document, the uploaded file is securely stored in object storage.
Where is your privacy policy?
AI processing
Which AI providers and models do you use?
Coassemble integrates directly with Google's AI services:
- Gemini Flash for text generation (course generation, document transformation, text refinement, translation)
- Gemini 2.5 Flash Image for AI-generated images
- Chirp for AI narration voices
How is customer data used in AI training?
Customer content, prompts and uploaded documents are never used to train the underlying models.
Who owns AI-generated course content?
The customer retains full ownership of all content created in Coassemble, whether AI-generated or manually authored.
Are there file size limits for uploads?
Large documents (100 pages and beyond) can be uploaded, but the resulting content will be heavily summarised. The models we use support a 1 million token context window, so document length is rarely the constraint. Our primary guidance is pedagogical: we recommend keeping courses under 25 screens.
Context window size is separate from your AI usage allowance. Narration tokens and image generation events are soft capped: going past your allowance starts a conversation with us rather than stopping generation. We'll get in touch before anything changes, so there are no surprise cut-offs and no automatic overage billing.
How long is model context retained?
Context required for course generation is stored long-term in our database.
What guardrails exist against AI hallucinations?
Our system includes guardrails designed to keep generated content aligned with training and learning objectives.
All LLMs remain susceptible to hallucinations, so full factual accuracy cannot be guaranteed. AI generation is intended to get creators 80 to 90% of the way to a complete course, with a human review pass recommended to finalise. The Review mode in the in-builder agent is designed for exactly that pass.
What's the failover strategy if an AI provider has issues?
We monitor model availability via BetterStack and use operational controls to maintain reliability.
In some configurations, Coassemble may use routing infrastructure (such as OpenRouter) to improve availability and manage failover across providers and models. See https://openrouter.ai/docs/features/uptime-optimization for more detail.
What happens if you change AI providers?
All customers are notified in advance. Partners on the Controlled Release server (previously referred to as Enterprise) receive an additional 2 to 4 weeks notice.
Subprocessors and infrastructure
Where are your subprocessors located?
Our subprocessor list is available via the Coassemble Trust Centre:
Do you vet your subprocessors?
Yes. We review vendor documentation and rely on published certifications and security assurances.
Who hosts the underlying infrastructure?
We use Render as our hosting provider. Render handles physical security, and the underlying infrastructure providers maintain SOC 2 Type 2 and ISO 27001 certifications.
How are denial-of-service attacks handled?
We rely on Render's built-in protections, and our infrastructure auto-scales to absorb high-load or DOS-style traffic.
Security testing
Do you conduct penetration testing?
Yes. We conduct an annual penetration test covering the platform broadly.
Third-party providers
What happens if a third-party AI provider experiences a breach?
We notify customers following our incident response plan and adjust provider usage as needed.