Security at Radplicity

Radplicity holds a learner’s name, work email, optionally a phone number, and their training record — what they were assigned, what they completed, and what certificates they hold.

We do not collect national identifiers, dates of birth, payment details, or health information. The product has no field for any of them. Data that is never collected cannot be disclosed, and this is the single largest reduction in risk we can offer a customer.

Where a learner needs an adjustment — extra time on an assessment, captions, keyboard-only navigation — Radplicity records the adjustment and never the reason for it. There is no field for a diagnosis or a condition, by design.

Every customer’s data is separated at the database itself, by row-level security policies that the application cannot switch off — not by a filter in application code that a missing line could skip. The connection the application uses has no privilege to bypass those policies.

This is verified on every single change to the software, by two automated suites. The first walks every table in the database and fails the build if one is not covered. The second authenticates as one customer, asks for another customer’s records by their real identifiers across every part of the product, and fails if anything comes back.

Permissions are scoped, not global. A manager responsible for one team sees that team — in the product and in every report and export, because the limit is applied when the data is fetched rather than when it is displayed.

Accommodation records sit behind a separate permission from the rest of a person’s profile, so somebody who administers training does not automatically see them.

Every change writes an audit entry recording who made it and when, in the same transaction as the change itself — so an action cannot succeed without being recorded.

Where a customer turns it on, Radplicity records browser events during an assessment, such as the window losing focus. Learners are told before they start.

Radplicity does not detect cheating and does not claim to. There is no integrity score, no percentage and no cheating label. A reviewer sees the raw events and draws their own conclusion. Nothing is recorded at all for a learner with an accommodation.

A person can ask their organization for a copy of everything Radplicity holds about them, and can ask to be removed. Radplicity supports both.

Removal takes out the person and keeps the training record. That is deliberate and is what the law contemplates: an organization has a legal reason to be able to prove somebody was trained, so the completion and the certificate remain, no longer attached to a name, an email or a login.

Data is encrypted in transit and at rest. Radplicity is not hosted on one cloud — it is built on a small number of managed services, and we would rather name them than describe them vaguely:

• Vercel — the application itself, and the custom domain each academy is served on.
• Neon — the PostgreSQL database, which holds everything Radplicity stores.
• Cloudflare — uploaded files, and video transcoding and delivery.
• Amazon SES — sending email. Recipients, their own course titles and their own due dates; nothing else.
• Anthropic — the optional AI layer, which can be switched off for your organization entirely, and which never receives a learner’s name, answers or progress.

Each of those publishes its own compliance documentation, and we will send you the current position for any of them on request rather than summarise it here, because a summary of somebody else’s certificate goes stale without anybody noticing.

None of it is our certification. Radplicity is not itself SOC 2 certified and we will say so plainly rather than borrow somebody else’s certificate. We are happy to complete a security questionnaire and to talk through anything on this page.

One thing customers ask that we would rather answer here than in a questionnaire: you cannot currently choose a region. Nothing in how Radplicity is built prevents it, and it is not something we offer today.

If you have found a security issue, please email security@radplicity.com. We would rather hear from you than not.

We will not pursue legal action against anyone who reports a vulnerability in good faith, gives us reasonable time to fix it, and does not access, change or keep other people’s data while investigating.