Trainio Security Overview

Introduction

Your training data — roleplay transcripts, feedback reports, team performance, and more — is critical to your business. At EducateMe Inc., the company behind Trainio, we take the security of our customers' data extremely seriously. We use software industry best practices to ensure the safety and integrity of all data stored on our platform. Read on to learn more about our security practices.

EducateMe Inc. is preparing for a SOC 2 compliance audit.

Product security

Authentication gates users' access to the specific data of their training space. Updates to the product are audited for good security hygiene. Several layers of authentication and authorization protect internal access to production data, including roleplay call transcripts and feedback reports.

Physical security

Trainio's production data is processed and stored within world-renowned data centers that use state-of-the-art multilayer access, alerting, and auditing measures.

System security

Servers and networking

All Trainio servers and structured datastores use managed infrastructure services provided and secured by Vercel and Amazon Web Services. Our web servers encrypt data in transit using the industry standard for HTTPS security (TLS 1.2 and TLS 1.3) so that requests are protected from eavesdroppers and man-in-the-middle attacks. Our SSL certificates are 2048-bit RSA or 256-bit ECDSA, signed with SHA256.

Storage

All persistent data is encrypted at rest using industry-standard AES-256 algorithms.

Operational security

Employee access

We use Google account infrastructure to verify employee account identity and require two-factor authentication for apps that access critical infrastructure or customer data. Access to administrative interfaces additionally enforces administrator permissions where applicable. All employee contracts include a confidentiality agreement.

Code reviews and production deployment

All changes to source code are subject to automated testing, and any that affect security require pre-commit code review by a qualified engineering peer that includes security, performance, and potential-for-abuse analysis. All code is deployed to a staging environment for quality assurance, and automated tests must pass prior to updating production services.

Service levels, backups, and recovery

Trainio's infrastructure utilizes multiple and layered techniques for issue mitigation and reliable uptime. We use highly redundant datastores, rapid recovery infrastructure, and point-in-time backups, making unintentional loss of customer data very unlikely.

Application security

Server and client hardening

Trainio servers use Vercel, Google Cloud, and Amazon Web Services managed infrastructure, which utilize firewalls to restrict system access from external and internal networks, DDoS mitigation, spoofing and sniffing protections, and port scanning prevention. Request-handling code paths have frequent user re-authorization checks, payload size restrictions, rate limiting where appropriate, and other request verification techniques.

Customer payment information

We use Stripe for payment processing and do not store any credit card information. Stripe is a trusted, Level 1 PCI Service Provider.

Questions?

If you have questions about our security practices, contact us at admin@educate-me.co. See also our Privacy Policy for details on how personal information — including voice roleplay preview data — is processed.