Your documents, your records, your people's privacy.

Your documents, training and records are stored in Amazon Web Services in Auckland, New Zealand. Data is encrypted in transit.

That is where the data is kept. Some of the processing happens elsewhere: AI drafting and narration run on AWS services in other regions, and email is sent and received in Australia. The list further down says which, service by service.

The Lernoa Business database is backed up once a day. Each backup is kept for 7 days on the server in Auckland and a copy for 14 days in Amazon S3 in Auckland, and the server's disks are also copied once a day, each copy kept for 7 days in Auckland. Restoring from a backup has been tested. Uploaded files are stored in Amazon S3 in Auckland and are not part of the database backups. Personal data we delete from the live service is gone from the backups within about 15 days, and until then we do not use the backups except to restore the service.

Training someone takes very little personal information, so that is all Lernoa Business keeps. For each person:

A mobile number is kept only for someone who chooses to get sign-in codes by text message. Custom fields are yours to add: keep them to work details such as an employee number or a start date. Your documents are your training material, so leave out personal information the training does not need.

Sign in with Google, Microsoft or an email address and password. Anyone can add a second step: a code from an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password, or a code sent by text message, with single-use recovery codes for a lost phone. It is each person's choice, and we recommend it for everyone who helps run your workspace.

Workspace roles (Owner, Admin, Manager, Learner) decide who can see and change what. The audit log records every change by an admin, every download of people's records, and the sign-ins of the people who help run the workspace, each with the IP address and device it came from. Admins can read it and download it as a CSV. Nobody can edit it, and IP addresses are removed after 12 months.

Single sign-on through your own identity provider (SAML) is not available yet. It is planned.

Course drafts are written by AI through Amazon Bedrock from the document you upload, with page references so a reviewer can check every line against the source. Your documents are used only to draft your training; Amazon Bedrock does not use them to train models. Our own service reads the text out of your PDF or Word file.

Audio narration is optional. Only when an administrator turns narration on does chapter text go to Amazon Polly to be read aloud, and we have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services.

AI output can be wrong or incomplete. That is what the review step is for: nothing the AI writes reaches your staff until an admin has reviewed and published it.

Personal focus works the same way. The AI drafts each focus section from your course, once per topic, and no one's name or results are sent with it. Who gets a section is decided by a plain rule on their final assessment answers, not by the AI.

Personal focus is a workspace setting that an administrator can turn on or off. It is off by default for workspaces in the United Kingdom, the EU/EEA and Switzerland, and on by default elsewhere. Turning it off deletes the strengths and focus areas already recorded.

Where personal focus is on, each person sees their own strengths and focus areas, and why their course has an extra section. Focus areas are there to help people learn, not to rate them.

Staff who already use Lernoa keep one login. Work content and personal content never mix.

Export training records as a CSV or a per-person PDF at any time. Records belong to the workspace and stay when a person leaves. If you cancel, your records stay read-only and exportable for 12 months, and you are emailed 30, 7 and 1 days before anything is deleted. A closed workspace is then deleted automatically, uploaded files included.

An administrator can also erase one person's personal data at any time with "Erase personal data": the person's name is replaced with a placeholder, and their contact details, notes, highlights, focus areas, questions, the text, images and IP addresses of their signatures, and their certificates are deleted. Anonymous completion figures stay, so the workspace's counts still add up.

Each service, who runs it and where it runs. The same list is on the sub-processors page, with what each one handles and the safeguard we rely on for transfers, and in Annex III of the Data Processing Addendum. We email each workspace Owner at least 30 days before we add or replace a provider.

• Encryption in transit: traffic between a person and the service uses TLS.
• Tenant isolation: the server checks every request against the signed-in person's membership, role and permissions in the workspace it names.
• Roles and permissions: Owner, Admin, Manager and Learner decide who can see and change what.
• Two-step sign-in: every account can turn on a second step at sign-in, a code from an authenticator app or a code sent by text message, with single-use recovery codes. The authenticator secret is stored encrypted and recovery codes only as hashes. It is each person's choice.
• Audit log: every change by an administrator, every download of people's records, and the sign-ins and two-step sign-in changes of the people who help run the workspace are written to a log the workspace's administrators can read and download. Each line records the IP address and browser it came from. Nobody can edit the log; IP addresses and browsers are removed from it after 12 months.
• Uploaded files: checked by their content rather than their name, stored under random names, and served only to signed-in members of that workspace. Nothing is public.
• Passwords: stored as salted hashes (ASP.NET Core Identity).
• Abuse protection: rate limits and bot checks on sign-up and forms.
• Reading a company website: protection against server-side request forgery, so the reader fetches only public addresses.
• Staff access: Lernoa staff access is limited to named staff, who are bound by confidentiality.
• Separation from personal Lernoa: Lernoa Business has its own database and its own accounts, separate from personal Lernoa.
• AI providers: they receive only the text a task needs (document content, training text, or the question a person types into Ask). Personal focus sends no person's name or results to AI. Amazon Bedrock does not use content to train models, and we have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services.
• Data minimisation: personal focus is off by default for workspaces in the UK, the EU/EEA and Switzerland, and nothing is recorded while it is off.
• Resilience and restore: The Lernoa Business database is backed up once a day. Each backup is kept for 7 days on the server in Auckland and a copy for 14 days in Amazon S3 in Auckland, and the server's disks are also copied once a day, each copy kept for 7 days in Auckland. Restoring from a backup has been tested. Uploaded files are stored in Amazon S3 in Auckland and are not part of the database backups.
• Export and deletion: administrators can export records as CSV files or per-person PDFs at any time and can erase a person's personal data themselves ("Erase personal data"). A closed workspace is deleted automatically on its deletion date, uploaded files included, and Lernoa staff delete an enquiry or a Business account on request.
• Sub-processors: each is bound by a written contract with data protection obligations equivalent to the ones in this DPA.
• Breach handling: we follow a written procedure for containing, assessing and reporting a personal data breach, so customers hear from us within the time the DPA sets.
• Physical security of the data centres: provided by AWS.

Single sign-on through your own identity provider (SAML) is not available yet.

These are the measures in Annex II of the Data Processing Addendum.

The Data Processing Addendum is part of the Terms and applies to every workspace, with the EU Standard Contractual Clauses and the UK Addendum built in. New Zealand has an adequacy decision from the European Commission and is recognised by the United Kingdom and Switzerland. A page for UK, EU and Swiss organisations, with an employee privacy notice template and facts for your impact assessment, is at UK and EU customers.

Email [email protected]. We answer security questionnaires for customers and prospects.