Security at LearnKasts.

Built on established cloud infrastructure.

LearnKasts uses cloud infrastructure and managed services to operate the platform. Depending on the service and workload, information may be processed or stored outside the user's country or outside Africa.

We do not currently represent LearnKasts as an Africa-only data-residency platform.

Data may cross borders.

LearnKasts serves educators, learners and organisations across multiple markets. Some infrastructure, subprocessors and service providers may process information outside the customer's country.

If a deployment has specific residency or transfer requirements, those requirements should be discussed during Enterprise discovery before implementation.

Protecting information in transit and at rest.

The application is served over HTTPS, and data stored through our managed database and object storage services is encrypted at rest by those services. Application secrets and sensitive stored values are kept out of source control and encrypted at the application layer where appropriate.

We describe transport and storage protection in general terms rather than publishing specific cipher, key-management or rotation details.

Access based on roles and permissions.

• Access requires an authenticated account.
• Organisation membership forms a boundary: members act inside their own organisation's data.
• Organisations assign granular roles, including instructor, teaching assistant, academic director, registrar, HR manager, finance officer and content editor, each carrying different permissions.
• Authorisation is enforced on the server for every request, not only hidden in the interface.
• Administrative and platform-operations screens are restricted to platform staff and gated by dedicated permissions.

Protecting account access.

• Password-based sign-in with hashed credentials and server-side session handling.
• Two-factor authentication is available on accounts.
• Organisations can set session policy, including session lifetime, idle timeout and whether a remember-me option is offered.
• Enterprise single sign-on over SAML 2.0, with roles mapped from a claim your identity provider sends.

SAML 2.0 is the supported enterprise single sign-on protocol today. OpenID Connect configuration is not available while outbound-request validation and provider discovery are completed.

Payment information is handled by payment providers.

LearnKasts uses third-party payment providers, currently Paystack and Flutterwave, to process learner payments. Card details are entered into the provider's payment experience rather than being stored by LearnKasts.

LearnKasts does not claim its own PCI DSS certification. Card data handling is the responsibility of the payment providers.

Privacy and data controls.

• Account holders can view and update their account information.
• Account and data deletion can be requested through our data deletion process.
• Notification and communication preferences are configurable.

Our Privacy Policy is the authoritative description of what we collect, why we collect it, who processes it and the rights available to you, including international transfers.

Logging and operational monitoring.

LearnKasts records application and operational events that help us investigate errors, secure accounts and understand important platform activity.

Organisation audit events cover selected administrative and organisational actions rather than every change in the system, and record which fields changed rather than their contents. We do not publish a retention period for these events.

Responding to security incidents.

We investigate suspected security incidents and work to contain, understand and remediate confirmed issues.

Where an incident affects customer or personal data, notifications are handled according to applicable legal and contractual requirements.

Found a security issue?

If you believe you've found a security vulnerability in LearnKasts, report it privately to security@learnkasts.com.

Please provide enough information for us to reproduce and investigate the issue, and avoid accessing or modifying information that does not belong to you.