Security, stated plainly

Where data lives

• The database is PostgreSQL on Neon, in Amazon Web Services' US East region (Northern Virginia). Neon encrypts stored data and keeps 24 hours of history, so the database can be restored to any point in the last day.
• The application runs on Render in the United States (Oregon). The site runs on Vercel. Every connection uses HTTPS, and browsers are told to refuse plain HTTP for this domain.
• Course content is delivered through Amazon CloudFront. It is the same for every customer and holds none of your people's data.
• Documents you upload for context are read into the database as text, and the uploaded file is deleted.

Signing in

• People sign in with an email address and a password. Passwords are stored only as bcrypt hashes, and must be at least eight characters with upper case, lower case, and a number.
• After ten failed sign-ins, an account cannot try again for fifteen minutes. Password recovery is limited the same way.
• A sign-in lasts at most 24 hours. Every request checks the account again, so a person you deactivate or move loses access at once, not when their sign-in expires.
• Single sign-on (Okta, Microsoft Entra ID, Google Workspace) and two-factor sign-in are not built today. If your policy requires either, tell us before you buy.

Who can see what

• Every organization's records carry its organization, and the application checks it on every read and write. There is no shared view across customers.
• Inside an organization, access follows role. A learner sees their own work. An administrator sees the organization.
• A small number of Thrive staff can see across organizations to run the service and answer support requests.
• Administrators can export their roster and progress as a spreadsheet at any time. To have an organization's or a person's data deleted, write to us; we confirm the request and do it by hand.

The agents

• ARIA, Morgan, and Coach Taylor run on Claude models from Anthropic. What a person types, and the records the agent needs to answer, are sent to Anthropic to write the reply. Anthropic's commercial terms do not allow it to train its models on that text.
• An agent works inside the permissions of the person it is talking to. It takes the organization from the signed-in account, never from anything a model writes. Morgan asks an administrator to confirm before it assigns courses, sends invitations, or buys seats.
• If you connect Microsoft Teams, session transcripts are read to write session summaries.

Services that handle your data

• Neon: the database.
• Render: the application.
• Vercel: the website.
• Anthropic: the agents' replies.
• Amazon CloudFront: course content delivery.
• Stripe: payments, on Stripe's own checkout page. Card details never reach our systems.
• Resend: email, including invitations and summaries.
• Microsoft Teams: live sessions, and transcripts if you connect it.
• Sentry: error reports, when error monitoring is turned on.
• Google Analytics: page measurement with Consent Mode. Cookieless pings can be sent before a visitor agrees; analytics cookies are used only after Allow analytics. LinkedIn: inquiry measurement only after a visitor separately agrees. Neither runs inside the platform.

What is not in place yet

• No SOC 2 report. We can walk a procurement reviewer through the controls on this page on a call, and share the attestations Neon, Render, Vercel, and Stripe publish.
• No third-party penetration test on file.
• No single sign-on and no two-factor sign-in, as above.
• No self-service deletion. Deletion is by request, as above.

Reporting a problem

If you find a vulnerability, write to hello@thrivetalentdevelopment.com with the subject "Security". We acknowledge within two business days and keep you informed until it is fixed. Please do not access data that is not yours while demonstrating an issue.