Trust & Security

Architecture & isolation

Every enterprise client runs on a dedicated deployment, not a shared multi-tenant pool.

• Dedicated instance per client — separate application, database, storage volume, admin credentials and backups. One client's data never shares a process or table with another's.
• Own domain & branding per client, with an automatic WCAG-AA contrast guard.
• Minimal dependency surface — the platform runs on the Python standard library, so there is no third-party package supply chain to compromise.

Encryption

• In transit: HTTPS/TLS enforced on every request (HTTP is redirected), HSTS enabled.
• At rest: data is stored on encrypted infrastructure volumes (Fly.io).
• Passwords are hashed with PBKDF2-HMAC-SHA256 (200,000 iterations), never stored in plaintext.

Authentication & access

• HMAC-signed sessions and tokens (SHA-256), verified with constant-time comparison; cookies are HttpOnly, SameSite and Secure.
• Enterprise SSO (OIDC) and SCIM 2.0 provisioning with automatic deprovisioning, so leavers lose access immediately.
• Brute-force throttling on login and separated admin / learner / API authorization scopes.

Application hardening & operations

• Security response headers (nosniff, X-Frame-Options, Referrer-Policy, HSTS), request-size limits, strict input validation and path-traversal protection.
• Weekly automated security audit covering authorization, headers, cookies, webhook verification and secret-leak checks.
• Secrets live in the platform secret store and access-restricted files, never in source code or the browser; payment webhooks are cryptographically verified.
• No card data, ever: payments are handled by Stripe and Tpay (PCI-DSS Level 1). Ludus is out of PCI scope.

Privacy & GDPR

For client account data we are the controller; for your learners' data we act as your processor.

• Data Processing Addendum available; roles aligned to GDPR Art. 28/32/33.
• EU data residency (primary region: Amsterdam).
• Retention with a 30-day export window after termination, then permanent deletion; earlier deletion on request.

Subprocessors

Certifications & attestations

We are not yet certified. Our controls are being aligned to the standards below, and we can share a self-assessment today.

• In progress ISO/IEC 27001 (information security) + 27018 (cloud PII protection)
• Planned ISO/IEC 42001 (AI management system) — responsible-AI governance for the course builder and assistant
• Available now CSA STAR / CAIQ self-assessment and this Trust page; full questionnaire on request

Security questionnaire (CAIQ-aligned)

Is customer data isolated between clients?

Yes. Each client runs on a dedicated deployment with its own application, database, storage volume and credentials. There is no shared multi-tenant data store.

Is data encrypted in transit and at rest?

In transit via enforced HTTPS/TLS with HSTS. At rest on encrypted infrastructure volumes. Passwords are PBKDF2-HMAC-SHA256 (200k iterations).

How do you handle user provisioning and offboarding?

Enterprise SSO via OIDC and automated provisioning/deprovisioning via SCIM 2.0. Deactivating a user at the identity provider revokes access immediately, including live sessions.

Do you store payment card data?

No. Payments run through Stripe and Tpay (PCI-DSS Level 1). Ludus never receives card numbers and is out of PCI scope.

Where is data hosted and who are your subprocessors?

Hosted in the EU (Amsterdam) on Fly.io. Subprocessors are listed in the table above; international transfers rely on the EU-US Data Privacy Framework or SCCs.

How do you test your security?

An automated security audit runs weekly (and after any auth/payment change), covering authorization, security headers, cookie flags, path traversal, webhook verification, secret leakage and brute-force throttling. Findings are remediated and logged.

How do we report a vulnerability?

Email hello@luduslms.com. We acknowledge responsible disclosures and respond promptly.