Data and security

How organization data, passwords, links and third-party course content are handled.

Organizations are isolated

Each organization sees only its own data: people, courses, results. Every request checks which organization the user belongs to.

Passwords and sign-in

• Passwords are stored only as a cryptographic hash (bcrypt). Nobody, admins included, can see a person's password.
• Invitation and password links work once and expire: 7 days for invitations, an hour for password changes. They're stored only as a hash.
• Google and Microsoft sign-in works only for people your organization has already added.

Third-party courses (SCORM)

SCORM packages open from a separate address, isolated from Spilno LMS, so scripts in a third-party course can't reach people's accounts.

Storage and backups

Connections are encrypted (HTTPS). The database and files are backed up every night.

Your data is yours

Reports can be exported to CSV at any time. AI only receives the learning material you chose; people's profile data isn't added to the request. More: AI generation.