Security policy
How Drivings protects learner accounts, study records, payments and service access.
Compliance and privacy
Use the framework pages to identify the evidence and service scope relevant to your review. Ask the Drivings team about documentation for your organisation.
Provider certifications apply to the services named in their own documents. Review Drivings controls and provider assurance separately.
Data security
The web and mobile apps use HTTPS to send information to our services. Supabase stores accounts and study records.
Privileged credentials live in managed secret stores. Website card details go directly to Stripe.
Access control
A guest session can record progress before you register. If you create an account, your study history can follow you.
Database policies restrict learner access to their own records. Staff tools use separate roles and database permissions.
Infrastructure
Vercel hosts the website. Supabase provides authentication and stores learner records.
The iPhone and Android apps connect to the same services over encrypted connections. Ask about regional processing or recovery scope for your review.
Network security
HTTPS protects information in transit between your device and the services it connects to.
Protected operations require the relevant session or staff permission. Provider security documentation describes the boundary of each managed service.
Application security
Protected routes check account identity and permissions. Database access rules enforce learner and staff boundaries separately.
Use the Contact tab to report a suspected vulnerability and include the affected route and enough information for us to reproduce it.
Payment security
Stripe collects card details on the website. Apple and Google handle payments made in their respective app stores.
Website subscription access is based on verified payment events. Billing support can work from a receipt or transaction reference.
Monitoring and logging
Technical and billing records help Drivings investigate errors, reconcile subscriptions and respond to support requests.
The privacy policy describes why different records are used and the criteria for retaining them.
Incident response
Use the Contact tab and choose Privacy and security. Include the affected page, the time you noticed the issue and steps to reproduce it where possible.
Keep passwords, session tokens and other people’s personal information out of your report.
People and awareness
Staff permissions are separate from learner accounts. Internal tools use role checks, and database grants restrict staff schemas.
Contact us to discuss staff access and the evidence relevant to your organisation’s security review.
Data privacy and your rights
You can request access, correction or deletion through the data request route. We may need to verify that you are authorised to make the request.
Account closure removes access to study history. Relevant financial records may be retained for legal and accounting purposes.
Vendors and subprocessors
The Service providers tab lists key vendors and their roles in delivering the product.
Ask about a specific feature to review the providers, processing scope and agreements relevant to your use.