Learning Platform

Learning Pool has completed a third-party audit of its management and data systems. The audit included a rigorous review of our technology infrastructure and operational processes and reflects our commitment to ongoing customer security. Find out more information on ISO 27001 here.

Learning Pool’s physical infrastructure is hosted and managed within Amazon’s secure data centers and leverages Amazon Web Services (AWS) and Amazon Elastic Compute Cloud (EC2) technology. 

The data is physically stored on servers in the UK and US. Backups are completed daily with a retention period of 7 daily, 4 weekly, and 12 monthly database backups. For file system backups, we have a 14-day retention policy.

Amazon continually manages risk, undergoing regular assessments to ensure compliance with industry standards. Amazon’s data center operations are accredited under:

• ISO 27001 and ISO 27017/8
• SOC 1, SOC 2, and SOC 3 / SSAE 16/ISAE 3402 (previously SAS 70 Type II)
• PCI DSS LEVEL 1

AWS puts a particular focus on compliance with new and changing regulations in the USA and EU, including:

• Sarbanes-Oxley (SOX)
• HIPAA
• Safe Harbor / Privacy Shield
• FISMA
• FEDRAMP
• DOD SRG
• EU Data Protection Directive (GDPR)

A complete list of Amazon’s certifications is available here.

All communication between Learning Pool servers and the client browser is secured using the Transport Layer Security (TLS) standard.

• Learning Pool supports the most relevant and secure level of TLS (currently 1.2 and above).
• The connection supports encryption using AES-256 CBC with SHA256 for message authentication and ECDHE RSA as the key exchange mechanism.

All user passwords are hashed. “Hashing” passwords means we don’t have access to the original passwords – and neither does anyone else. So even if our databases were ever compromised, every individual password would remain secure.

Learning Pool conducts annual third-party penetration testing on its systems to validate that no technical vulnerabilities have been missed. Executive summaries are available on request.