Trust and security

This page explains how CTI Academy protects the data of organizations that use Team Workspace and of the people who train on the platform. If your security team has a questionnaire, send it to info@ctiacademy.io and we answer it in writing.

1. Hosting and data location

The application and its database run on servers operated by Hetzner Online GmbH in Nuremberg, Germany, in the European Union.

Traffic reaches the servers through Cloudflare, which terminates TLS and filters attacks. Media files such as certificate images are stored in Cloudflare R2.

2. Encryption

• All traffic is encrypted with TLS, and ctiacademy.io and its subdomains send HSTS so browsers never fall back to plain HTTP
• Passwords are stored as salted Argon2 hashes, never in a readable form
• Single sign-on client secrets, authenticator secrets and webhook signing secrets are encrypted at the application level with keys that can be rotated
• SCIM tokens are stored only as SHA-256 hashes and are shown once, when they are created

3. Access to your workspace

• Single sign-on: SAML 2.0 and OpenID Connect with Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, ADFS and other standard identity providers. SAML responses must be signed with SHA-2, are checked against your IdP certificate, audience, recipient and validity window, and are accepted once. An email domain is trusted only after you prove you own it with a DNS record
• Provisioning: SCIM 2.0 creates, updates and deactivates accounts from your identity provider. Groups become teams, and deactivating someone in the IdP frees their seat
• Two-factor for the console: every owner, admin, team manager and auditor signs in with an authenticator app. Passkeys (Touch ID, Windows Hello, security keys) can be added on top
• Fresh confirmation: role changes, exports, deactivations, single sign-on changes, integrations and privacy settings ask for a new code even inside an active session
• Sessions: the owner sets the idle timeout and the maximum session length
• Roles: owners and admins manage the workspace, team managers see only their teams, auditors can read but not change anything

4. Privacy by design

• Admins see training data only: activity on the platform, progress, scores, assignments and certificates. They never see IP addresses, devices, browsers, locations, passwords or anything outside CTI Academy
• Accounts an organization creates are never linked to anyone's personal CTI Academy account
• Members appear on public leaderboards only under a random username that reveals neither their name nor their employer, and the owner can switch public profiles off
• Privacy mode shows team averages instead of individual figures, for works councils and rules that limit performance monitoring. It can apply to team managers only or to everyone
• Team Workspace accounts are excluded from our marketing CRM

5. Audit log

Every console action is recorded with who did it, their role, what changed and when. Entries cannot be edited or deleted by anyone in the workspace, and they hold no IP addresses or device details.

The log exports as CSV with an event ID and the time in UTC (ISO 8601), ready for a SIEM. Entries are kept for at least two years, or as long as training records when that is longer.

6. Retention and deletion

• The owner chooses how long training records are kept after a seat is closed, from one to five years. What the workspace holds about that person (assignments, progress, team history, name and email) is then deleted automatically. Certificates stay verifiable
• When a contract ends, we delete the workspace's records, or return them to you first if you ask
• Individual members can delete their own CTI Academy account from their settings at any time
• The database is backed up every day, and backups are kept for 14 days

7. Sub-processors

These companies process data for us. We tell Team Workspace customers before we add one.

• Hetzner Online GmbH, Germany: hosting of the application and database
• Cloudflare, Inc., global network: DNS, TLS, attack filtering and storage of media files (R2)
• Google LLC: transactional email (Google Workspace); the optional AI study analysis (Gemini API), only for members who open it; website analytics (Google Analytics), only with cookie consent
• Polar Software, Inc.: payments for individual Premium and Student plans. Team Workspace seats are invoiced under contract and do not go through Polar
• HubSpot, Inc.: email and CRM for individual sign-ups. Team Workspace accounts are excluded

Marketing cookies from HubSpot and LinkedIn are set on the website only with consent.

8. Provisioning

SCIM base URL: https://enterprise.ctiacademy.io/api/enterprise/scim/v2. Authenticate with a bearer token created in Team Workspace, Settings, Security.

• Supported: Users (create, read, filter by userName or externalId, replace, patch, deactivate) and Groups (create, rename, add and remove members, delete), ServiceProviderConfig, ResourceTypes and Schemas
• Okta: use the SCIM 2.0 app with "HTTP Header" authentication and the userName as the email address
• Microsoft Entra ID: Enterprise application, Provisioning, Automatic, with the Tenant URL and Secret token above
• DELETE and active=false deactivate the account and free the seat. Accounts are never hard-deleted over SCIM
• A member belongs to one team, so adding someone to a group moves them to that team
• Provisioning beyond your seat count answers 409 with a message your IdP shows

9. Webhooks

Team Workspace can post to Slack, to Microsoft Teams (through a Workflows webhook) or to your own HTTPS endpoint. Endpoints must be public: private, loopback and link-local addresses are refused. Failed deliveries are retried after 1, 5, 30 and 120 minutes.

Each request to your endpoint is a JSON envelope with id, type, created, organization and data, and carries three headers:

• X-CTIAcademy-Event: the event type, for example assignment.overdue
• X-CTIAcademy-Delivery: the event ID; the same event is never delivered twice once it succeeded
• X-CTIAcademy-Signature: t=<unix time>,v1=<hex>, where v1 is HMAC-SHA256 of "t.body" with your signing secret. Reject requests older than five minutes

Events: assignment.overdue, assignment.completed, certificate.earned, member.activated, member.deactivated and digest.weekly. With privacy mode on, events about one person name their team instead of the person.

10. Data processing agreement

We provide a Data Processing Agreement under Article 28 of the GDPR for Team Workspace customers. It covers the subject and duration of processing, the categories of data, our confidentiality and security obligations, sub-processors, assistance with data subject requests, breach notification and deletion or return of data at the end of the contract.

Ask for it with the demo form or at info@ctiacademy.io.

11. Reporting a vulnerability

If you find a security issue, email info@ctiacademy.io with the details and how to reproduce it. We confirm receipt, keep you updated and credit you if you wish. Please do not access other people's data or disrupt the service while testing.