Security & Privacy Overview
How GXPLearn.io is hosted, authenticated and operated. Last updated: September 2026.
This overview describes how GXPLearn.io is built and operated today. It is intended to support security and procurement reviews — not to replace your own risk assessment or validation decisions.
Certification status
We do not currently hold SOC 2 or ISO 27001 certification.
Platform purpose
GXPLearn.io is an independent educational platform for GxP, GMP, CSV, CSA and validation learning. It provides guided modules, simulations and evidence-review exercises for professional development. It is not a validated GMP system, not a learning management system (LMS) for employer-mandated training records, and not affiliated with Emerson or DeltaV.
Architecture overview
The platform is a static web application served to browsers, with account services and data storage provided by Supabase (PostgreSQL, authentication and Edge Functions) and payments handled by Stripe. Learner progress is stored locally in the browser and synchronised to Supabase when a user is signed in. Marketing pages, the training app and related assets are built as static exports and deployed to Vercel.
Hosting
Public marketing pages and the training application are hosted on Vercel as static assets. Application data (profiles, licences, progress and lead submissions) is stored in a Supabase-managed PostgreSQL database. Edge Functions on Supabase handle checkout sessions, payment webhooks, analytics ingestion, lead notifications and staff-only reporting.
Authentication
User sign-in is managed by Supabase Auth. Learners can register and sign in with email and password (with email confirmation enabled in production) or with OAuth providers configured in Supabase (Google, Microsoft and LinkedIn). Session tokens are issued by Supabase and used by the client to access permitted data. We do not operate a separate identity server.
Data storage
Account data (email, display name, licence status) is stored in Supabase profiles and licences tables. Module progress is stored as JSON in user_progress when cloud sync is active, and in browser local storage for offline resilience. Business demo enquiries are stored in a leads table. Product analytics events are stored in analytics_events. Payment card details are processed by Stripe; we receive transaction metadata but not full card numbers.
Encryption in transit
All production traffic between browsers, Vercel, Supabase and Stripe is served over HTTPS (TLS). API keys and secrets are not embedded in client-side code beyond the Supabase anon (publishable) key and Stripe publishable key, which are designed for browser use with row-level security and server-side validation.
Access controls
Row-level security (RLS) is enabled on profiles, licences, user_progress and leads. Users can read and update only their own profile and progress. Licence records are readable by the owning user. Lead submissions can be inserted by anonymous visitors but are not readable from the client. Analytics events have no direct client read or write policies — ingestion goes through a dedicated Edge Function. Staff analytics dashboards are gated behind an authenticated Edge Function. Service-role keys are used only in server-side Edge Functions, never in browser code.
Privacy posture
We do not sell learner data or use it for advertising profiles. The training app does not use third-party advertising cookies. Personal data is processed to deliver the service, enforce licences, respond to support requests and operate the platform. See our Privacy Policy for legal bases, retention and data-subject rights.
Data retention
Account and progress data are retained while your account remains active and as needed for legal, tax or dispute-resolution obligations. When you request account deletion, we delete or anonymise personal data within 30 days unless we must retain specific records by law. Analytics and lead records are retained for operational reporting and then reviewed periodically.
Incident response contact
To report a suspected security vulnerability, unauthorised access or privacy incident, email support@gxplearn.io with a clear description and any relevant details. We review security reports promptly and will contact you if we need additional information.
Educational platform scope
GXPLearn.io is designed for learning and practice — not for generating GMP batch records, electronic signatures under 21 CFR Part 11, or Annex 11–compliant audit trails. Completion state and scores support learner progress and product analytics; they are not offered as validated training records or regulator-approved certification. Organisations remain responsible for their own training compliance programmes and system validation decisions.
Ready to practise regulated workflows?
Choose the path that fits — start with free foundation modules or discuss a team licence for your organisation.
For individuals
Start with the free foundation modules and upgrade when you are ready for simulation labs and professional scenarios.
For businesses
Request a business demo or pilot discussion for team/site licensing, standalone export, and onboarding use cases.