What should I know about Embed security, data protection, and AI?

# What should I know about Embed security, data protection, and AI?

Common security, data protection, compliance, authentication, and AI questions for teams building with Coassemble Embed.

## Data storage, regions, and encryption

### Where is data stored and processed?

By default, all customer data is stored and processed on US-based infrastructure (currently Oregon, USA). This includes course content, uploaded documents, and AI processing.

### Can you guarantee data is processed in a specific region?

Yes, on the Controlled Release server (previously called Enterprise) with region locking enabled. Region-Locked Server options are available for the UK and EU. The Standard Release server (previously Production) does not currently offer this guarantee.

### What encryption standards are used?

- **Data at rest:** AES-256.
- **Data in transit:** TLS 1.2.
- **Database:** encrypted at rest, with keys managed by our hosting provider.

## Environments and server options

### Are different environments segregated?

Yes. Production and testing use separate environments and separate databases.

### What server options are available?

Your server environment is chosen up front as part of setup and cannot be changed afterwards without starting a new account. The options are:

- **Standard Release server** (previously Production): a shared environment that receives platform updates immediately on each release.
- **Controlled Release server** (previously Enterprise): a shared environment that receives updates two weeks after the Standard Release server, giving extra preparation time.
- **Region-Locked Server**: data processed and stored within a specified region (UK or EU) for data residency or compliance requirements.
- **Dedicated server**: a private, single-tenant environment, which can optionally be region-locked.
- **Self-hosting**: the application runs in your own infrastructure, subject to commercial approval.

## Authentication and cookies

### Does the embedded experience use cookies?

No. The Embed flow is cookie-less by design so it works reliably inside iframes, which avoids problems caused by third-party cookie blocking in embedded contexts (for example, when Safari or Chrome treats an iframe as a third party). Coassemble does use cookies for the regular, non-embedded login experience.

### How does authentication work in an embedded session?

Authentication uses a short-lived token (JWT) rather than a cookie-based session on Coassemble's domain:

1. When the embeddable mounts, it holds a JWT in memory.
2. It uses that JWT for each request to Coassemble's server.
3. The JWT expires after 3 hours.
4. A refresh mechanism maintains continuity when the token expires.

## Access controls and logging

### What internal access controls are in place?

We follow an internal Access Control Policy, available on request. Only authorised engineers have administrative access to production systems.

### Are audit logs maintained?

Yes. API calls and data access are logged across our systems.

## Compliance and documentation

### What certifications do you hold?

A SOC 2 Type 2 certification. Documentation is available via the Coassemble Trust Centre at [trust.coassemble.com](https://trust.coassemble.com/). Our hosting infrastructure (via Render) sits on providers that maintain SOC 2 Type 2 and ISO 27001 certifications.

### Are you GDPR compliant, and do you have a DPA?

Yes to both. Our standard Data Processing Agreement (DPA) is available and includes provisions covering data processing for AI-driven features.

### Can you provide audit reports or security assessments?

Yes, on request.

## Data retention and deletion

### How long is uploaded data retained?

Indefinitely by default, unless deletion is requested.

### How do I delete data?

Use the Embed API to delete courses through the available endpoint. Any UI to trigger deletion is built into your own integration. Opt-out processes are usually implemented on your side, and the course deletion endpoint supports those workflows.

## Backups, incidents, and monitoring

### What backups are in place?

Point-in-time recovery, allowing restoration to any point within the last 7 days.

### What is your incident response plan?

We maintain an Incident Response Plan and a Business Continuity and Disaster Recovery Plan, both available on request.

### How do you detect security and availability issues?

We use Vanta for continuous monitoring of data security and privacy controls, BetterStack for real-time system and model availability monitoring, and Segment to detect unusual usage patterns.

## Privacy and PII

### Does Embed require me to pass PII?

No. The Embed API does not require you to pass any PII to identify users, and we recommend sharing only anonymous identifiers with Coassemble.

### What data is collected when documents are uploaded?

Uploaded documents are converted into a format the language model can process, and only document content (not PII) is sent to the model. When you use a feature like Transform a document, the uploaded file is securely stored in object storage.

## AI processing

### Which AI providers and models do you use?

Coassemble integrates with Google's AI services: Gemini Flash for text generation (course generation, document transformation, text refinement, translation), Gemini 2.5 Flash Image for AI-generated images, and Chirp for AI narration voices.

### Is customer data used to train AI models?

No. Customer content, prompts, and uploaded documents are never used to train the underlying models.

### Who owns AI-generated content?

You do. The customer retains full ownership of all content created in Coassemble, whether AI-generated or manually authored.

### Are there token or file size limits for uploads?

There are no strict token limits. The models support a 1 million-token context window, and large documents (100 pages or more) can be uploaded, though the resulting content will be heavily summarised. The main guidance is pedagogical: keep courses under 25 screens.

### What guardrails exist against AI hallucinations?

The system includes guardrails to keep generated content aligned with training and learning objectives. All language models can still hallucinate, so full factual accuracy cannot be guaranteed. AI generation gets you 80 to 90% of the way to a complete course, with a human review pass recommended to finalise it.

### What happens if an AI provider has issues or changes?

We monitor model availability via BetterStack and use operational controls to maintain reliability. In some configurations Coassemble uses routing infrastructure such as OpenRouter to improve availability and manage failover. If we change AI providers, all customers are notified in advance, and partners on the Controlled Release server receive an additional 2 to 4 weeks notice.

## Subprocessors and infrastructure

### Where are your subprocessors listed?

Our subprocessor list is available via the Coassemble Trust Centre at [trust.coassemble.com](https://trust.coassemble.com/). We vet subprocessors by reviewing vendor documentation and relying on published certifications and security assurances.

### Who hosts the infrastructure, and how are denial-of-service attacks handled?

We use Render as our hosting provider. Render handles physical security, and the underlying infrastructure providers maintain SOC 2 Type 2 and ISO 27001 certifications. We rely on Render's built-in protections, and our infrastructure auto-scales to absorb high-load or denial-of-service traffic.

### Do you conduct penetration testing?

Yes, an annual penetration test covering the platform broadly.


Security & AI FAQ

Build with the Coassemble API and embeddable components.

API keys

Embed overview

Self-hosting

Tenant caps

Releases

Embed getting started

Embeddables

Developers

Getting started in 5 minutes

What is Coassemble?

Terminology

Workspace tour

Getting started FAQ

Sign up

Coassemble as an LMS

Migrate from other tools

Getting started

Supported file types

Create from a document

Create options compared

Cloud storage

Create from slides

Sources overview

Sources you build from

Folders

Creators

Transfer ownership of your workspace

Common questions: Workspaces

Managing account, workspace, and billing settings

Workspace management

Course Collections

Collections overview

Courses overview

End-user (learner) experience

Screens

Brand kit

Create from scratch

The Finish screen

Quizzes

Languages

Media: images

Which screen to use

Create a course

Course creation FAQ

Media: video

Publish a course

Themes

Manage & edit courses

Content curation

White-labeling

AI course creation

Custom fonts

Asset library

What you can build

Course links & access

Publish & share

Share to Slack

SCORM export

Sharing FAQ

Shareable templates

Email invitations

Custom domain

Embed in your product

Deploy via MCP

Where training goes

Learners & tracking

Course analytics

Link analytics

SCORM usage

Reporting FAQ

Quiz results

Sentiment

Collection analytics

Analytics overview

Report dashboard

Webhooks

API events

Write data back via MCP

Where results go

Flow

Pulse

Embed Core

Embed Automate

Embed Partner

Overage & rates

Usage limits

Payments & billing

Plans & pricing overview

Plan changes

Plans & billing

Explore best practices for sharing your knowledge.

Build the business case for Coassemble

Assessment: Best practice for quizzes

Best practices

SCORM files not loading

SCORM session errors on Apple devices

Why isn't my Embed screen working?

Common questions: Troubleshooting

What do I do if there is a bug?

Troubleshooting

Security & SOC 2

Accessibility

Our approach to AI

AI & data security

Trust

Loom

Stripe

Notion

YouTube

HubSpot

Arcade

Vimeo

Unsplash

360Learning

aNewSpring

Docebo

Integrations overview

Slack

Connect with the API

Connect your AI model

Integrations

Release notes

Updates

Resources specifically for Embed (previously referred to as Headless course creation). These are resources that previously lived on the Headless Resources Hub.

Coassemble Embed Partner Security, Data Protection & AI FAQ

Default usage caps for clients

Managing tenant caps

Accessibility guide

AI and Data Security for Coassemble Embed Partners

Coassemble vs. Articulate: Feature comparison guide for course authoring teams

Coassemble is WCAG 2.2 Level AA Conformant

Competitor analysis

Designing effective microlearning courses

How to access and interpret the Headless usage report

How to handle competitor objections when positioning your Embed solution

Guide to pricing models for Coassemble Embed and key competitor benchmarks

Sales enablement guide: Driving user adoption

Customer testimonials for Coassemble Embed course creation (sales enablement)

Our mission: Barrier-free knowledge transfer (partner-friendly positioning language)

Getting started guide

How to communicate Coassemble feature releases to your customers 

How to migrate courses from other authoring tools into Coassemble Embed

Guide to releases

Curate

AI Create

Customize

Learner experience

Self-hosting Coassemble Embed

Initial AWS requirements for self-hosting

Embed Partners

Coassemble's AI: how it builds courses, screens, quizzes, images and narration, and how you stay in control.