What layers of encryption are used to protect data at rest and in transit?

### **What layers of encryption are used to protect data at rest and in transit?**

Our data stores containing sensitive customer data are encrypted at rest. We use secure data transmission protocols to encrypt confidential and sensitive data when transmitted over public networks.

### **What internal access controls are in place to restrict access to customer-uploaded data?**

We follow an internal Access Control Policy, which can be provided upon request.

### **Are audit logs maintained for access to customer data? Are these logs available for review?**

Yes, audit logs are maintained. However, making these logs available for review would be difficult.

### **Are different environments (production, development, testing) segregated? How is data isolated between them?**

Yes. We use separate environments and separate databases for both testing and production.

### **Do you have current certifications such as SOC 2 or ISO 27001?**

Yes. We hold a **SOC 2 Type 2** certification.

More information: <https://trust.coassemble.com/>anon

### **Are you compliant with GDPR requirements?**

We comply with GDPR requirements; however, we do not hold a formal GDPR certification.

### **Can you provide recent third-party audit reports or security assessments upon request?**

Yes.

### **Do you have a Data Processing Agreement (DPA) or similar documentation available?**

Yes.

### **How do you handle opt-out requests and data transparency?**

Opt-out processes would typically be implemented on your side. We do provide an endpoint that allows deletion of courses.

### **How long is customer-uploaded data retained by default?**

Indefinitely, unless removal is requested.

### **Is there an option for customers to request deletion of their data?**

Yes. Using the API, you can delete courses via the available endpoint. Any UI for this would need to be built into your integration.

### **Do you have a mechanism for scheduled or automatic purging of inactive or aged data?**

No.

### **Can customers configure their own data retention policies via the API or admin interface?**

No.

### **How do you ensure secure data processing and storage?**

We follow an internal Data Management Policy, which can be provided upon request.

### **Where is data stored once received by your system? Are there geographic restrictions?**

Data is stored in **Oregon, USA**.

### **What measures are in place to detect and respond to data breaches?**

We have an **Incident Response Plan** as well as a **Business Continuity and Disaster Recovery Plan** to respond to data-related incidents. These can be provided upon request.

### **Where is data stored (cloud or on-premises)? Please specify regions.**

Data is stored in the cloud in **Oregon, USA**.

### **What is your data retention policy?**

Data is retained indefinitely unless removal is requested.

### **What backup procedures ensure data integrity and availability?**

We support point-in-time recovery, enabling us to restore data to any point within the last **7 days**.

### **Do you implement continuous monitoring of data security and privacy metrics?**

Yes. We use **Vanta** for ongoing monitoring of data security and privacy controls.

### **Do you have an incident response plan to address data breaches promptly?**

Yes. We can provide the policy upon request.

### **What types of data are collected when a customer uploads documentation?**

Uploaded documents are converted into a format suitable for processing by the LLM. We do **not** send any PII to the LLM—only document content.

### **Is any personally identifiable information (PII) stored or processed by your system?**

No. The Headless API integration does not require passing any PII to identify users.

### **Do you have a published privacy policy?**

Yes: <https://coassemble.com/privacy-policy>

### **Is customer data shared with any third-party services or subprocessors?**

We do not share any PII with third-party subprocessors. Uploaded documents are shared with an LLM model (Google Gemini) for processing.

### **Do you anonymize data before sharing it?**

This is generally not applicable, as PII is not required for the Headless integration. As a Headless partner you should only share anonymous identifiers with Coassemble.

### **Do you vet and monitor subprocessors for data security and privacy compliance?**

Yes.

### **Are contractual agreements in place with all subprocessors outlining data-handling obligations?**

No.

### **Are documents shared with AI providers?**

When using features such as *Transform a document*, the uploaded file is securely stored in object storage. Only non-PII content is sent to the LLM for processing.

### **Do you have a DPA that covers AI processing?**

Yes — our standard DPA includes language covering data processing for AI-driven features.

### **What is your failover strategy if an AI provider experiences downtime or rate limiting?**

We use **OpenRouter**, which provides high availability and manages automatic failover across multiple LLM providers.

Reference: <https://openrouter.ai/docs/features/uptime-optimization>

### **How do you validate failover behavior?**

Failover functionality is tested in our staging environments.

### **How do you monitor model availability?**

We use **BetterStack** for real-time system and model availability monitoring.

### **What guardrails exist to reduce hallucinations and improve content accuracy?**

Gemini Flash 2.5 is significantly more accurate than earlier generation models, but all LLMs remain susceptible to hallucinations. Our system includes guardrails designed to ensure generated content aligns with training and learning objectives, though 100% factual accuracy cannot be guaranteed.

### **How accurate is generated content?**

Our AI generation tools are intended to get creators **80–90% of the way** to a complete course.

### **How do you track hallucination incidents?**

We track issues through user feedback.

### **Are there token or file size limits for document uploads?**

There are **no strict token limits**. Our primary guidance is pedagogical — we recommend keeping courses under 25 screens. Large documents (100+ pages) can be uploaded, but the resulting content will be highly summarized.

### **What is your model context window?**

The models we use support a **1 million-token context window**, making size constraints unlikely.

### **Do you implement rate limiting per user or tenant?**

No.

### **How do you monitor for abnormal usage patterns?**

We use **Segment** to detect unusual or unexpected usage.

### **How do you protect against resource exhaustion attacks?**

We leverage protections built into **Render**, and our infrastructure auto-scales to absorb high-load or DOS-style traffic.

### **Have your AI features been independently audited for AI-specific risks?**

No. We have not undergone third-party audits specifically for AI functionality.

### **Do you conduct penetration testing?**

Yes. We conduct a **yearly penetration test**, though not AI-specific.

### **Where are AI processing requests executed?**

All AI data requests are processed in the **United States**.

### **Can you guarantee US-only processing for compliant customers?**

Yes — geographic locking can be provided for **Enterprise servers**. Standard servers cannot guarantee this.

### **Where are your subprocessors located?**

Our subprocessor list is available here: <https://trust.coassemble.com/>

### **What happens if you change AI providers?**

All customers are notified in advance. Delayed-release customers receive an additional **2–4 weeks** notice.

### **Who owns AI-generated course content and learning materials?**

The customer retains **full ownership** of all content created in Coassemble, whether AI-generated or manually authored.

### **How long is model context retained?**

Context required for course generation is stored **long-term** in our database.

### **What physical and logical access controls exist?**

We do not manage physical servers. Render provides all physical security controls.

### **Is the database encrypted at rest?**

Yes. The database is encrypted at rest. We do not manage encryption keys; they are managed by our hosting provider.

### **What certifications does your hosting provider hold?**

Render’s underlying infrastructure providers maintain **SOC 2 Type 2** and **ISO 27001** certifications.

### **Do you have SLAs for AI performance?**

No, there are currently no SLAs specific to AI functionality.

### **Are there usage rate limits?**

**AI narration** features will introduce a monthly limit of **500,000 tokens** (per plan). Additional limits may apply for future features.

### **Do you have written data processing agreements with Google/Gemini?**

No. We rely on Google’s standard contractual terms:

<https://ai.google.dev/gemini-api/terms#data-use-paid>

### **What encryption standards are used for stored and transmitted documents?**

Documents and data are protected using **TLS 1.2** and **AES-256** encryption.

### **Who manages encryption keys?**

Keys are managed at the database level by our providers.

### **How do you validate model availability and failover?**

Through tests in staging environments and monitoring via BetterStack.

### **What human review steps are required before publishing AI-generated courses?**

None are mandatory.

### **Do you notify users about limitations of AI-generated content?**

Not currently. This is an acknowledged gap and will be addressed.

### **What vulnerability management processes exist?**

Covered by our standard penetration testing and security policies already shared.

### **Can you guarantee US-only AI processing contractually?**

Yes — on Enterprise servers with region locking enabled.

### **How do you authenticate to AI provider APIs?**

Via secure API authentication mechanisms (Google/Gemini and OpenRouter).

### **What logging exists?**

API calls and data access are logged across our systems.

### **Who has administrative access to production systems?**

Only authorized engineers with the appropriate access controls in place.

### **Have you assessed Google/OpenRouter’s security posture?**

Yes. We review vendor documentation and rely on their published certifications and assurances.

### **What happens if third-party AI providers experience a breach?**

We notify customers following our incident response plan and adjust provider usage as needed.

Security questions

Headless course creation

Headless course creation – Q&A

Release notes

Getting help: How Coassemble support works

General

Getting started: Common questions

What is a collection?

How to log in to your account

What is a screen?

What tone should I select?

Coassemble terminology explained

How do I sign up for a Coassemble account?

Can I use Coassemble as an LMS?

What file types can I transform into a course?

Accessing the login page

Getting to know your Coassemble workspace

Build the business case for Coassemble

What is Coassemble?

Getting started

Connecting to Google Drive or OneDrive

Convert a presentation into an online course

Your knowledge

Configuring your email preferences

Folders

Transfer ownership of your workspace

Common questions: Workspaces

Organizing courses with folders

How to delete a creator

Managing account, workspace, and billing settings

Creators

Your workspace & settings

Brand kit: A complete guide

Managing logos

Managing and defaulting themes

Creating and configuring themes

How to upload custom fonts in Coassemble

Asset library

Brand voice

How to save a legacy course theme

Transitioning to Brand kit for legacy users

Brand kit: Saving pre-existing themes

Brand kit for users on Free

How to apply Brand voice when generating courses

Using the Brand kit

How to edit video details

Brand kit

Creating courses from scratch

Coassemble's AI

Transforming a document to a course

Common questions: Course creation

Upload your videos to your course

How do I create a course?

Videos

AI image generation

Deleting courses

Generate a screen with AI

Refine with AI

Translations

Screens

Difference between transforming a document and converting a presentation

Generate a course with AI

Narration

The Finish screen

Enforce completion of videos

Images

Publishing

Loom integration

Customizing course appearance with Themes

How to preview and review a course

Managing and editing your course

Duplicating courses

Which screen should I use?

The Quiz screen

Create & customize

How Coassemble tracks unique anonymous users

Template links

How to import a course from a template link

How to share your courses

Sharing courses with Slack

Collections

SCORM packages and translations

Exporting courses as SCORM

Common questions: Sharing

Email invitations

Can I add my courses to another platform?

Sharing course links & invitations

Sharing

Analyzing course-level Insights

Analyzing Collection-level Insights

Tracking content performance with Insights

Link Insights

Sentiment

SCORM usage

Common questions: Insights

How to filter Course insights by date range

Course insights

Detailed Quiz results

Insights

Token usage

How do I upgrade from the free plan?

Team plan

Logging in with Microsoft

Free Plan

Payments, billing, and subscriptions

Enterprise plan

Plans and advanced features

Explore best practices for sharing your knowledge.

Assessment: Best practice for quizzes

Accessibility

Coassemble is WCAG 2.2 Level AA Conformant

Best practices

Why isn't my Embed screen working?

Where is the learner dashboard?

SCORM files not loading

What do I do if there is a bug?

SCORM session errors on Apple devices

Common questions: Troubleshooting

Requesting a password reset link

Setting a new password

How to change or reset your password

How do I ask learners to provide a longer typed response to a question?

Troubleshooting

Coassemble's approach to AI

AI & data security

SOC 2 compliance

How do I remove a creator's access to Coassemble?

Data security & AI

YouTube

Notion

Vimeo

Unsplash

Arcade

Hubspot

Docebo

aNewSpring

360Learning

Connections & Integrations

Guide

Support.coassemble.com

Security questions

Share

Share

Security questions

Share

Share