Security & data protection
SwiftSCORM handles training content and, on the hosted platform, learner completion records. Here's how that data is protected, in plain language. Questions: security@swiftscorm.com.
Your training documents
When you generate a quiz, the document text is sent over an encrypted connection to our AI provider (Anthropic) to write questions, then returned to your browser. We process it in memory to fulfill the request and do not store it on SwiftSCORM servers; Anthropic may retain API inputs and outputs for a limited period under its own commercial policy, and does not use them to train models by default. The finished SCORM package is assembled in your browser and downloaded directly to you.
Learner data on the hosted platform
If you publish a course to SwiftSCORM hosting, we store the course and each learner's completion record (name/email if you provide it, score, pass/fail, date): this is the compliance audit trail you rely on. Access is gated by unguessable 144-bit tokens: a private dashboard token for you, a per-learner invite token for each employee. Token pages are marked no-index, no-referrer, and no-store so they don't get crawled or leak via outbound links. Owner sign-in also runs on a signed session cookie (magic-link email verification), with the legacy dashboard-token link kept working for compatibility.
Result integrity
Whether a learner passed is determined on our server from your passing threshold, not accepted from the learner's browser. Completion is monotonic (a later attempt can't erase a pass) and keeps the best score. This is what makes the dashboard usable as evidence.
Platform hardening
Every page is served with a Content Security Policy, HTTP Strict Transport Security, clickjacking and MIME-sniffing protections, and a locked-down permissions policy. Data-changing and public endpoints are rate-limited. We don't advertise our framework or leak internal errors to clients.
Responsible disclosure
Found a vulnerability? Email security@swiftscorm.com with details and steps to reproduce. Please give us a reasonable window to fix it before public disclosure; we'll acknowledge your report and credit you if you'd like.
What we're still improving
We believe in being honest about posture. Access to hosted training data is enforced today in the application layer: every dashboard and learner action is scoped to a signed owner session or an unguessable owner or invite token and checked on our server, results are computed server-side, and token pages are no-index, no-referrer, and no-store. Verified-email sign-in (magic link plus a signed session cookie) already ships. Additional database-layer hardening exists in code and migrations for newer subsystems, but we do not claim it as production protection until its activation is proven; until then the application-layer checks above are the enforced boundary. Also pending: tightening our Content Security Policy to per-request nonces. We'll update this page as each item is proven live.
Accessibility
SwiftSCORM targets WCAG 2.1 Level AA conformance. The training player includes keyboard navigation, screen-reader announcements (aria-live), visible focus indicators (focus-visible), and reduced-motion support. SCORM packages set the correct lang attribute for all five supported languages. See our Accessibility Conformance Report (VPAT 2.4) for full details.
Security question or something to report? Write to us; a real person reads it.
Contact security →