Security at AcademyAI

Overview

This page covers how we protect customer data: the controls we build ourselves, and the certifications held by the providers we run on.

Last reviewed: July 2026 · Contact: security@academyai.co

At a glance

• Single sign-on through WorkOS (SAML, OIDC, and SCIM directory sync).
• Data residency: customer data can be pinned to a US or EU database region.
• Encryption everywhere: TLS 1.2+ in transit; AES-256-GCM for stored third-party credentials, on top of provider-managed disk encryption.
• No training on your data: our AI providers do not use paid-tier prompts or responses to train their models.
• Audit log of admin-level actions across the platform.
• Every core sub-processor holds SOC 2 Type II and/or ISO 27001, listed in full below.

Authentication and access

Sign-in runs through WorkOS AuthKit, which handles hosted login, SSO (SAML and OIDC), and session issuance. Session cookies are encrypted with a dedicated secret, and incoming WorkOS webhooks are signature-verified before AcademyAI acts on them.

Access inside AcademyAI is multi-tenant and role-based: organisations, teams, and departments are modelled explicitly, and permissions are enforced against that structure. Organisations can also require SSO for every member, closing off password-based login entirely.

Encryption

• In transit: TLS 1.2+ everywhere, from the browser to Vercel's edge, and between every backend service.
• At rest, application layer: long-lived third-party credentials (for example, Slack bot tokens) are encrypted with AES-256-GCM before they're stored, independent of the underlying database's own encryption.
• At rest, infrastructure layer: Neon and Vercel encrypt all stored data at the disk level as part of their own SOC 2 and ISO 27001 programs.

Data residency

Each organisation on AcademyAI selects a data region (US or EU), and that choice determines which Neon database project its data lives in. Region selection is per-organisation, not a global default.

Application security

• CSRF protection on state-changing requests.
• Bot and abuse protection via Vercel BotID.
• Authenticated cron endpoints, so scheduled jobs can't be triggered by an outside request.
• Markdown and XSS hardening, with a dedicated automated test suite, since AI-generated and user-submitted content is rendered as Markdown throughout the product.
• Constant-time comparisons for secret and token checks, closing off timing-based attacks.

Audit logging

Admin-sensitive actions (role changes, course edits, organisation context changes, connector installs, document access, credential use) are written to a central audit log as they happen, so admins have a record of who did what.

How we use AI, and how your data is used

AcademyAI uses large language models to power assessment, course generation, and the in-app assistant. This is usually the first question enterprise buyers ask, so here's the direct answer:

• Google Gemini, our primary model provider, runs on paid API and Vertex AI access. Under Google's terms for paid usage, prompts and responses are not used to train or improve Google's models, and are logged only briefly for abuse and policy enforcement.
• OpenAI, used for text embeddings, does not use API data to train its models by default. Data submitted through the API is retained for a limited window (30 days or less) solely for abuse monitoring.
• PostHog handles product analytics and LLM observability (tracing model calls for debugging and quality). It does not use this data to train models, and offers an EU-hosted option for customers who need analytics data to stay in the EU.

In short: your content is sent to run the product, not to train someone else's model.

Data we process

AcademyAI does not process payment card data or health records, and is not designed for use by children under 16.

Sub-processors

AcademyAI relies on a small number of well-audited providers to run the product. This is the full list of sub-processors that touch customer data, along with the certifications each one holds. We link to each provider's own trust centre as the source of truth. Certifications are re-verified on our standard review cadence, since they change over time.

Core infrastructure

Realtime and collaboration

AI and analytics

Integrations and messaging

Media

Internal tooling (not in the customer data path)

Common questions

Is data encrypted in transit and at rest?

Yes. TLS 1.2+ in transit; provider-managed disk encryption at rest, plus AES-256-GCM application-layer encryption for stored third-party credentials.

Do you support SSO?

Yes. SAML and OIDC through WorkOS, with SCIM directory sync for provisioning.

Where is our data hosted? Can we choose a region?

US or EU, selected per organisation.

Do your sub-processors hold SOC 2 or ISO 27001?

Yes. Every provider in our data path (Vercel, Neon, WorkOS, Ably, Liveblocks, Nango, Slack, Resend, PostHog, ElevenLabs) holds SOC 2 Type II, ISO 27001, or both. See the full list above.

Is our content used to train AI models?

No. We use paid-tier access to Google Gemini and OpenAI specifically because it comes with a contractual no-training guarantee on prompts and responses.

Do you keep audit logs of admin actions?

Yes. See "Audit logging" above.

Contact

Have a security questionnaire, need a signed DPA, or want more detail on any control above? Reach us at security@academyai.co.