Security, hosting & backups

Last updated: 15 October 2026. See also our Privacy Policy and Terms of Service.

1. Where data is hosted

CourseForge's database, sign-in service and file storage (course packages, videos, PDFs, evidence and certificates) run on managed cloud infrastructure hosted by Amazon Web Services in the Asia Pacific (Mumbai, India) region. The website and server functions are delivered through Cloudflare's global edge network, so pages load from a location near the user. Data is not currently stored exclusively in Australia. Organisations with an onshore-only data-residency requirement should contact us before purchase.

2. Sub-processors

Application platform, database, sign-in and file storage: Lovable Cloud (Lovable Labs Incorporated), running on Supabase infrastructure in Amazon Web Services' Mumbai region. Web delivery: Cloudflare. Account emails (sign-up confirmation and password reset): sent by Lovable Cloud's built-in authentication email service. Payments: Stripe (card details are handled by Stripe, never stored by CourseForge). SMS: SMS Messenger (SL Interactive), only when SMS is used. AI assessment assistance: Lovable AI Gateway, which currently routes requests to Google Gemini models, only when an authorised user requests it. AI voiceovers: Google Gemini text-to-speech via Lovable AI Gateway, only when a user generates a voiceover.

3. Encryption

All connections to CourseForge use HTTPS/TLS encryption in transit. Data held by our hosting provider is encrypted at rest.

4. Access control and isolation

Every database table uses row-level security, so each organisation and user can only reach records their role permits. LMS actions check organisation roles (admin, trainer, assessor, learner, employer). Uploaded files sit in access-controlled storage. Optional two-factor authentication (authenticator app) is available to every user, and when enabled it is enforced on data and file access, not just at sign-in. API keys are scoped, revocable and stored only as hashes.

5. Backups and recovery

The production database is backed up automatically by our managed hosting provider. Course Studio projects also keep a full version history: every cloud save is stored as a content-addressed version that can be restored, and deleted projects stay in trash for 30 days. Specific backup frequency, retention period and recovery-time figures are available on request; we provide them in writing so they reflect the current configuration rather than a marketing claim.

6. Your own copies

You can export any course as a standard SCORM .zip package at any time, and LMS records can be exported for your student management system. We recommend organisations keep their own copies of critical content in line with their recordkeeping obligations.

7. Monitoring and incidents

We run automated security scanning and dependency checks. Suspected incidents can be reported to hello@aisi.au. Our data breach response plan follows the OAIC's four steps: contain the breach, assess the risk of serious harm (within 30 days at most, and as quickly as possible), notify affected organisations, individuals and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it, and review to prevent recurrence. Affected customer organisations are told promptly so they can meet their own obligations. Live service health is shown on our status page.

8. Requesting more detail

For security questionnaires, vendor assessments or written backup and data-location statements, email hello@aisi.au with your organisation name and requirements. No online service can guarantee zero risk; we are open about what we do and do not provide.