Security
Coheart is built on enterprise-grade infrastructure. Here's how we keep your data safe and your organisation compliant.
- Data residencyAzure UK South — primary data residency in the UK
- All platform data (learner records, assessments, outcomes, certificates) is stored exclusively in Microsoft Azure UK South (London) data centres. As the sole exception, recipient email addresses are transmitted to Mailchimp Transactional (USA) to deliver service emails such as password resets and session reminders; this transfer is protected by Standard Contractual Clauses with the UK ICO Addendum. Data processing agreements are available upon request.
- EncryptionTLS 1.3 in transit · AES-256 at rest
- All data in transit is protected using TLS 1.3 with strong cipher suites. Data at rest is encrypted using AES-256 via Azure Storage Service Encryption. Database backups are encrypted at rest and retained for 30 days.
- Access controlRBAC and secure session management
- Coheart uses role-based access control (RBAC) with four clearly defined roles: Platform Admin, Organisation Admin, Facilitator, and Learner. All sessions use server-side opaque tokens stored as SHA-256 hashes — never JWTs in localStorage.
- ComplianceGDPR · UK DPA 2018 · ISO 27001 aligned
- We are compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our security practices are aligned with ISO/IEC 27001 information security management standards. A Data Protection Officer (DPO) is designated and contactable at dpo@coheart.io.
- Vulnerability managementRegular pen-tests · responsible disclosure programme
- We conduct annual third-party penetration tests and address findings in order of severity. Dependencies are monitored for known vulnerabilities using automated tooling. We operate a responsible disclosure programme — if you discover a security issue, please email security@coheart.io and we will respond within 5 business days.
Have a security concern or want to request our Data Processing Agreement?
Contact our security team