Drivings Security and Privacy

Compliance and privacy

Independent assurance
SOC 2 and ISO 27001 scope
Privacy frameworks
GDPR, HIPAA, KVKK and CCPA
Payment assurance
Stripe and PCI DSS

Data security

Encrypted connections
HTTPS for the site and apps
Protected credentials
Server side secret storage
Learner records
Database access controls

Access control

Learner sessions
Guest or signed in study
Database policies
Access to your own records
Staff permissions
Separate access roles

Infrastructure

Web hosting
Vercel
Accounts and data
Supabase
Mobile apps
Shared service infrastructure

Network security

Transport encryption
HTTPS connections
Protected service access
Server side authentication
Provider boundaries
Hosting and database roles

Application security

Request validation
Inputs checked by the service
Access checks
Sessions and role permissions
Report a concern
Dedicated contact route

Payment security

Website payments
Processed by Stripe
App payments
Apple and Google billing
Subscription access
Verified payment events

Monitoring and logging

Service operations
Errors and reliability
Billing events
Subscription and payment history
Privacy
Retention varies by purpose

Incident response

Report a concern
Contact privacy and security
Share useful context
Affected page and steps
Protect your information
Keep credentials out of reports

People and awareness

Staff access
Role based permissions
Separate records
Restricted staff data
Security questions
Contact our team

Data privacy and your rights

Personal information
Access and correction
Account deletion
Available in the app
Retained records
Billing and legal obligations

Vendors and subprocessors

Core services
Hosting and authentication
Billing
Web and app store payments
AI features
Model routing when used

Data requests

Make a data request

Access and correction
Review or update your data.
Deletion
Request removal of personal information.

Recovery and continuity

Discuss recovery

Backup scope
Ask what records are covered.
Restoration
Discuss your continuity requirements.

Security assessment

Discuss assessment

Application safeguards
Review protection of learner data.
Evidence
Ask about documentation for vendor review.

Privacy policy

Information we use
What we collect and why.
Your rights
The choices available to you.

Security policy

Security safeguards
How we protect access and payments.
Reporting
How to report a concern.

Subprocessor list

Provider roles
Hosting, accounts, payments and AI.
Processing scope
Read the relevant provider information.

Data processing agreement

Discuss agreement

Processing scope
Explain the workflow you intend to use.
Organisation requirements
Discuss applicable terms with us.

SOC 2 report

Ask about the report

Audit scope
Identify the service and controls in scope.
Evidence
Ask about report access.

ISO 27001 certificate

Ask about the certificate

Certificate scope
Identify the organisation and services covered.
Validity
Ask about the issuer and dates.

HIPAA requirements

Explore requirements

Intended workflow
Review the features and data involved.
Agreements
Discuss applicable safeguards.

Security overview

View security controls

Accounts
How we separate learner and staff access.
Infrastructure
The services that support Drivings.

Product methodology

Read methodology

Learning material
How we create and review lessons.
Sources
Where our statistics come from.

Scope
Account, study, billing and support information where applicable.
Review documents
Privacy policy and processing purposes

KVKK

Scope
Personal information involved in using the service where applicable.
Review documents
Types of personal information and processing purposes

CCPA

Scope
Personal information and rights applicable to the request.
Review documents
Privacy policy and categories of information

PCI DSS

Scope
Stripe’s payment services and the relevant Drivings checkout workflow.
Review documents
Stripe’s current PCI documentation and scope