Security, stated plainly

Where data lives

• The database runs on Neon in the United States, encrypted at rest, with point-in-time recovery backups.
• The application runs on Render (backend) and Vercel (site), both over TLS. Data is encrypted in transit.
• Payments are handled by Stripe. Card details never reach our systems.
• Email is sent through Resend. Live sessions run on Microsoft Teams.

Access

• Access inside the platform is limited by role: learners see their own work, administrators see their organization, Thrive staff see what they need to run the service.
• Passwords are stored as salted hashes. Login attempts are rate-limited.
• Single sign-on (Okta, Azure AD, Google Workspace) is scoped with organizations above five hundred people and is not a standard feature today.

The agents

• ARIA, Morgan, and Coach Taylor use a language model provided by Anthropic. Conversation text is sent to that provider to generate replies and is not used to train their models under our agreement.
• Agents act inside the permissions of the person they are talking to. They cannot read another organization's data.

What is not in place yet

• No SOC 2 report. We can walk a procurement reviewer through the controls above on a call and share vendor attestations for Neon, Render, Vercel, and Stripe.
• No third-party penetration test on file. Dependency and code review happen as part of every release.

Reporting a problem

If you find a vulnerability, write to hello@thrivetalentdevelopment.com with the subject "Security". We acknowledge within two business days and keep you informed until it is fixed. Please do not access data that is not yours while demonstrating an issue.