Enterprise-grade security.
Evalanta is built from the ground up to meet the strict security and compliance requirements of regulated industries.
How we protect your data
GDPR aligned
Data subject access, erasure, and portability are built into the platform.
Encryption in transit & at rest
TLS for all traffic and disk-level encryption for stored data.
Least-privilege access
Role-based access controls for staff, with full audit logging of sensitive actions.
Certifications & Coverage
Security Certifications
- SOC 2 Type IIIn progress — Q4 2025 target
- ISO 27001Planned — 2026
- GDPR AlignmentComplete
- Australian Privacy ActComplete
Cyber Insurance
Includes coverage for data breaches, business interruption, cyber extortion, and regulatory fines.
Security by design.
We employ defence-in-depth strategies to keep your organisation's data safe.
- Encryption at rest and in transit
- Role-based access control (RBAC)
- Automated backups with point-in-time recovery
- Continuous dependency and vulnerability scanning
- Separation of production and development environments
- Self-hosted observability stack (no third-party analytics)
Infrastructure resilience
Evalanta is hosted on managed cloud infrastructure with automated failover and auto-scaling. For specific availability targets or a custom SLA, please contact the team.
Data Processing Agreement
Download our standard DPA for your records. For custom DPAs or security questionnaires, please contact our legal team.
Subprocessors
We engage the following subprocessors to deliver Evalanta. Updated quarterly.
| Subprocessor | Service | Location | Data |
|---|---|---|---|
| Vercel Inc. | Hosting & edge functions | USA | Application data, logs |
| Supabase Inc. | Database & authentication | USA | User accounts, course data, payments |
| Stripe Inc. | Payment processing | USA | Payment card data (PCI DSS Level 1) |
| Bunny.net | Video hosting & CDN | EU (Slovenia) | Course video assets |
| LiveKit Inc. | Real-time video & audio | USA | Live session recordings |
| OpenAI | AI content generation | USA | Course generation prompts & outputs |
| Anthropic | AI content generation | USA | Course generation prompts & outputs |
| Resend Inc. | Email delivery | USA | Email addresses, email content |
| Cloudflare Inc. | CDN & DDoS protection | USA | Network metadata |
| Google Cloud | AI (Gemini) | USA | Generation prompts & outputs |
| ElevenLabs | AI voice synthesis | USA | Audio generation data |
| Neon | PostgreSQL hosting | USA | Database storage |
Self-Hosted Services
These services run on our own infrastructure and do not share data with third parties.
| Service | Purpose | Location | Data |
|---|---|---|---|
| Meilisearch | Search engine | Self-hosted (Singapore) | Course & user search indexes |
| Umami | Analytics | Self-hosted (Singapore) | Anonymized page views |
| GlitchTip | Error tracking | Self-hosted (Singapore) | Error logs (no PII) |
| Plane | Project management | Self-hosted (Germany) | Support ticket sync |
Last updated: May 2025. Previous versions available upon request. For DPA requests, contact legal@evalanta.com.
System Status
Real-time status of Evalanta services. Subscribe to incident notifications.
Web Application
Main website and learner portal
OperationalAPI
REST and GraphQL APIs
OperationalPayments
Stripe, SSLCommerz, bKash (subject to final partnership approval with bKash), Nagad
OperationalVideo Streaming
Bunny Stream CDN
OperationalAI Services
Eve chatbot, content generation
OperationalEmail Delivery
Resend email infrastructure
OperationalHave specific security requirements?
Our security team can provide detailed documentation, fill out security questionnaires, and discuss custom compliance needs.