# Security and procurement

The answers a company's procurement, IT or legal team usually asks for before it buys training delivered on Learnt. Every line here is true today. If a question isn't answered, email [hello@learnt.tech](mailto:hello@learnt.tech).

## Who runs Learnt

Learnt is run by Michael Orlando, an individual based in Minnesota, United States, not yet a registered company. Contracts are with him under the [Terms of Service](https://learnt.tech/terms). This page will say so when that changes.

## Support

- Email [hello@learnt.tech](mailto:hello@learnt.tech). A real person reads it.
- We reply within 1 business day (Monday to Friday, US Central time).
- There's no phone support line and no on-call team.

## Where data is stored, and who processes it

Course content, learner names and emails, progress, quiz results and certificates are stored by Supabase in the United States. Learnt doesn't sell data, show ads or contact your learners for its own purposes.

These providers process data for Learnt, each only for its own job:

| Provider | What it does | What it touches |
|---|---|---|
| Supabase | Database, sign-in and file storage (United States) | Accounts, course content, rosters, learning activity |
| Vercel | Hosting and content delivery | All web traffic to Learnt pages |
| Stripe | Subscription billing | Client payment details (card numbers never reach Learnt) |
| Resend | Email delivery | Recipient names and emails for sign-in links and notices |
| Google | Email delivery for invitations, reminders and learner questions sent from the learnt.tech address; Learnt's own business email; analytics on learnt.tech marketing pages | Recipient names and emails, support email, marketing-site visits |
| Anthropic | AI drafting when a client imports a PDF or asks Learnt to expand or revise a module | Only the document or module the client sends, never learner data |

The full list and what each one does is in the [Privacy Policy](https://learnt.tech/privacy#providers).

## Security

- Every page and API call uses HTTPS (encrypted in transit). Supabase encrypts stored data at rest.
- Each workspace can reach only its own data. Every server request is scoped to the caller's workspace in code, and the database's row rules do the same for the pages that read it directly. An automated test suite checks on every change, before it reaches production, that one workspace can't reach another's courses, learners, progress or questions.
- Learners sign in with a one-time email link, so they have no password to leak. Course Editor admins use an email and password.
- Payment details stay with Stripe.
- Only Michael Orlando has administrative access to the production systems. Learnt is built and run with AI coding tools (Claude Code) that act on his instructions, under his review.
- Your training site (`yourname.learnt.tech` or your own domain) carries no advertising or analytics trackers.

**What Learnt doesn't have yet:** a SOC 2 or ISO 27001 report, single sign-on (SSO), two-factor sign-in for admins, or more than one admin per workspace. Ask if one of these is a requirement; it helps us decide what to build next.

## Data processing agreement (DPA)

Need a DPA? Email [hello@learnt.tech](mailto:hello@learnt.tech). We'll review yours, or send ours once it's been reviewed by our attorney.

## Your data when you leave

- **Learner records:** download progress as a CSV file, per client organization, while your workspace is active (Progress page, or `GET /progress.csv` in the [API](https://learnt.tech/docs/api)). After it locks, email us and we'll send it.
- **Your course:** **Download course** in the Course Editor gives you the whole course as one markdown file, the format the markdown import reads, with quizzes kept as notes. It works even after your trial ends or you cancel. Details: [Course content](https://learnt.tech/docs/course-content#download-your-course).
- **After you cancel, or a trial ends without a subscription:** the workspace stays for 90 days so you can come back, then it's deleted, including learner records. You get an email a week before, with the link to download your course. Ask and we'll delete it sooner, and confirm when it's done. Backup copies are deleted within 30 days after that.
- **One learner's records:** ask and we'll delete them.

## Limits

- One course per workspace.
- One admin per workspace.
- Unlimited learners and client organizations, with no per-learner fees.
- Invitations: 25 in any 24 hours during the trial, 500 once the paid subscription starts.
- Pictures: JPG, PNG, WEBP or GIF, up to 4 MB each; pictures in modules up to 500 MB per workspace.
- PDF import: up to 4 MB and 60 pages.
- Video: YouTube or Vimeo links that play in place; Learnt doesn't host video files.
- API: 120 requests a minute per key.

## Uptime

Learnt runs on Vercel and Supabase. We don't offer a service-level agreement or service credits, and the [Terms](https://learnt.tech/terms) (section 10) make no promise of uninterrupted service.

## Price

$99 a month per workspace after a 14-day free trial with no card. Details: [Pricing](https://learnt.tech/pricing).