Security FAQ

Through Supabase Auth. Learners sign in with email and password (email confirmation required in production) or with OAuth providers we enable in Supabase — typically Google, Microsoft and LinkedIn. Sessions are managed by Supabase; we do not store passwords in our application database.

Progress and account metadata are stored in Supabase PostgreSQL (profiles, user_progress and licences tables). The browser also keeps a local copy in localStorage for resilience and faster load. Clearing browser data removes the local copy; signed-in users can restore progress from cloud sync on next sign-in.

Yes. Production connections to the website, Supabase APIs and Stripe use HTTPS (TLS). Do not use the platform over unsecured networks for account access.

Data stored in Supabase benefits from Supabase's platform-level encryption at rest on their managed infrastructure. We do not operate separate customer-managed encryption keys.

Learner account data in Supabase is protected by Supabase's managed database infrastructure. We do not offer customer-specific backup export or restore services as part of the standard product. Organisations requiring formal backup SLAs should discuss requirements during procurement.

Email support@gxplearn.io to access, correct or delete your personal data. We respond in line with applicable privacy law. Account deletion requests are processed within 30 days unless a legal retention obligation applies. See Privacy Policy for full details.

We collect product and marketing analytics events (such as page views, CTA clicks and funnel steps) via a Supabase Edge Function. Events may include session ID, page path, referrer, user agent and, when signed in, user ID. Analytics are used to understand usage and improve the platform — not for advertising profiles. The analytics_events table has no direct client INSERT policy.

When you submit a business demo or pilot enquiry, the information you provide (name, email, company and message) is stored in our leads table and may trigger an internal notification via a Supabase Edge Function. Leads can be submitted anonymously but are not readable from the public client.

No. GXPLearn.io is an independent educational platform for learning CSV, CSA and validation concepts. It is not validated GMP software, not a substitute for site-specific computer system validation, and not intended for use as a regulated manufacturing or quality system.

No. Module completion and scores support learner progress inside the product. They are not offered as GMP training records, employer-mandated training evidence or regulator-approved certification. Your organisation remains responsible for its own training compliance programme.

No. The platform is not designed or validated for Part 11 electronic records/signatures or Annex 11 computerised systems used in GMP manufacturing. Regulatory references in training content are for educational context only.

No. We do not currently hold SOC 2 or ISO 27001 certification. This Trust Centre documents our current controls and subprocessors so you can assess fit for your organisation's requirements.

Email support@gxplearn.io with a description of the issue, affected URLs or accounts if known, and steps to reproduce where applicable. We treat good-faith security reports seriously and will follow up as needed.