Security at Okudemia
Authentication, isolation and recovery are handled at the platform level, so nothing critical depends on how one organization configured it.
Authentication
Multi-factor authentication
Enforced through the identity provider and applied to every account according to organizational policy. Because it is enforced at the identity layer rather than in the application, it covers every way into the platform.
Single sign-on (SAML / OIDC)
Connect an existing identity provider so users authenticate with established corporate credentials. Accounts follow the directory: when access is withdrawn there, it is withdrawn here.
Sessions and timeouts
Sessions are bounded and warn before they expire, so an unattended browser does not stay signed in indefinitely. Tokens are held in memory for the life of the session rather than written to durable storage.
Access control
Role-based access control
Permissions follow designated roles: administrators oversee the organization, managers see their own team, and learners access strictly their own material. Every permission is granted explicitly rather than inherited by default.
Custom roles and permissions
Roles are editable, so an organization can grant a coordinator exactly the rights they need without making them an administrator. Guards prevent the last holder of a permission from being removed.
Least privilege by default
A new account is a learner until someone grants it more. Administrative surfaces are not merely hidden from other roles — the endpoints behind them refuse the request.
Data
Data isolation
The platform is multi-tenant and every organization's data is partitioned. Isolation is enforced on the server for each request rather than assumed from what the interface offers.
Encryption in transit and at rest
Network traffic is encrypted end-to-end over TLS, and all stored data and uploaded files remain encrypted at rest.
Backups and recovery
Regular backups are maintained alongside a recovery path that is tested rather than assumed. A restore is a rehearsed procedure, not a first attempt during an incident.
Personal data and erasure
Personal data is processed under the applicable data-protection law, and an administrator can erase a member's personal data while preserving the training record the organization is required to keep.
Minimal cookies
Only the cookies the platform needs are set — sign-in, language and theme. No analytics or advertising cookies are used.
Platform
Uploaded content is served from a separate origin
Uploaded material — packages, documents, images — is author-supplied, so it is never served from the application's own origin. It runs in an isolated sandbox that cannot reach the session or the tokens behind it.
Audit logs
Actions taken on accounts, assignments and content are systematically recorded and made reviewable by administrators, alongside a log of the messages the platform has sent.
Browser hardening
A content security policy, strict transport security and a restrictive permissions policy are applied at the edge and asserted on every deployment, so a missing header fails the pipeline rather than reaching a browser.
Practices
External penetration testing
The platform is tested by an external party on a regular cycle, and findings are tracked to closure rather than filed.
Dependency and code scanning
Every change passes static analysis, a dependency audit and a container scan before it can be released. A new finding stops the release; it does not become a backlog item.
Separate environments
Development, staging and production are separate, with production data confined to production. Changes are exercised on staging first.
Reporting a vulnerability
If you believe you have found a security issue, contact us through the details on the contacts page. We will confirm receipt and keep you informed while we investigate.
What the platform does
Learning delivery, assessment, records, reporting and administration — the full feature set in one place.