Security and data protection

• Where data is held

  Amazon Web Services in US East (N. Virginia): the application, its database, files and email. Learners' code runs on our own code runner in Finland, with no names attached.

• Sign-in

  No passwords. People sign in with a single-use code sent to their email, with Google, or through their LMS. Sessions end after seven days without use.

• Encryption

  TLS on every connection to the site, with browsers told to use HTTPS only. Uploaded files and backup copies are encrypted at rest in Amazon S3.

• Backups

  A database backup every day, checked, kept for 14 days and copied off the server. A restore is rehearsed every three months.

• Uptime

  A 99.5% monthly target for paid subscriptions, measured every three minutes and shown on our public status page.

• Certifications

  None yet: no SOC 2 report, ISO 27001 or Cyber Essentials certificate. Below is what we do instead, and what is still missing.

• No passwords. People sign in with a code sent to their email, with Google, or through their organisation's LMS (LTI 1.3). A code works once, for ten minutes, only in the browser that asked for it, and is stored only as a keyed hash. Guessing is limited for each address and across the whole service.
• Sessions use HTTP-only, secure cookies. The token is stored only as a hash, and a session ends after seven days without use and after 30 days at most.
• Roles. An organisation's admins see all of it, instructors the batches they teach, and learners only their own work. People from an employer the organisation trains for see only the learners linked to them, never their code. Parents see their own children.
• Organisations kept apart. Each organisation's records are scoped to it. An automated suite runs against a real database with two organisations and checks, on every change before it can be released, that neither can read or change the other's records.
• Our staff. A small number of named RunCode employees are platform administrators. They open an organisation's records only for its own support request, a security problem or a legal duty.
• History. An organisation's admins see the changes its staff make on its History page. It is a working record, not a tamper-proof audit log, and it does not record who viewed what.

• The database is backed up every day, checked readable and kept for 14 days on the server. Each backup is also copied, encrypted, to a private S3 bucket in a separate AWS account, where the server can add copies but never read or delete them, and each copy is deleted after 13 days.
• A restore into a scratch database is rehearsed every three months, checking every migration and the data. Our targets after a failure: at most 24 hours of data lost, and the service back within 4 hours.
• Every change passes the type check, the automated tests, the two-organisation suite and the browser tests before it can be released. A release backs up the database first and checks its own health before it takes over.
• An uptime monitor checks the service every three minutes and alerts us, and we are alerted if a daily backup does not arrive. Its record is public on our status page.
• For paid subscriptions we aim for 99.5% availability each calendar month, as that monitor measures it. Maintenance announced on the status page in advance does not count. It is a target without service credits, and the trial and free plan have no uptime commitment.
• When the code runner is busy, grading waits and tries again. It never marks an answer wrong because of load.

AI hints for learners are written by Claude, Anthropic's AI model, through Anthropic's API, with processing kept in the United States. They are part of the Training plans and the free plan, not the Teacher plan.

• Off until you turn them on. An organisation admin turns AI hints on in Settings, and can turn them off again for any batch.
• Never for children. Children taught under a parent's consent never get AI hints, whatever the settings: the server refuses them.
• What the model sees. The question, the learner's code and its output, and the visible tests' results. Never names, email addresses or hidden tests.
• No training on your data. Anthropic's commercial terms say it may not train models on customer content from its services (read on Anthropic's site on 10 November 2026). We train nothing on your data ourselves.
• Hints, not answers. Hints come from fixed buttons with no chat box, are never offered in exams, and are checked before they are shown: the first two levels may name a function or a short expression but hold no block of code, and the third holds at most five lines. AI never decides a grade. Staff can see every hint, and each learner has at most 100 a month.
• Safeguarding. If what a learner writes suggests they may be at risk, they get no hint and are told where to get help, and the organisation's safeguarding lead is emailed a link to it.

AI drafting for staff uses Claude through the same API, with processing kept in the United States. Admins and instructors ask it for a first draft of multiple-choice questions or a lesson's text on every plan, and of a coding question with tests on the Training plans and the free plan.

• Off until you turn it on. An organisation admin turns AI drafting on in Settings, separately from AI hints. Each organisation has at most 100 drafts a month.
• Staff only. Learners never use it. What the model sees is what the staff member types and the material they give; nothing about learners is sent.
• People decide. A draft is seen only by the person who asked and the organisation's admins, and nothing from it reaches learners until staff check it and add it. A drafted coding question's tests are run against a worked solution before staff see them.

• If a personal data breach affects your organisation's data, we tell you within 48 hours of becoming aware of it, so you can meet your own duties to your regulator.
• To report a security problem, email hello@theskillsite.com with Security in the subject. Our contact details for researchers are also in security.txt.
• Please do not reach or change data that is not your own, and give us time to fix a problem before you share it. We do not run a paid bug bounty.

• Data Processing Agreement

  Part of the terms every organisation accepts at signup, with the ICO's International Data Transfer Agreement for data leaving the UK. Ask us for a signed copy.

• Student data privacy

  What we commit to under FERPA, the UK and EU GDPR, and Canadian and Australian privacy law, and how we sign a district's own agreement.

• Accessibility statement

  How far the platform meets WCAG 2.2 AA, the problems we know about, and a conformance report on request.

• Privacy policy

  What we collect, why, how long we keep it, and the rights of the people it is about.

• Security questionnaires

  Send us yours. The HECVAT is available on request from hello@theskillsite.com.