Trust · Kureos LearningKureos World AB · Sweden

Where your people's data lives, and who can reach it.

Written for the security, privacy and procurement teams who review Kureos Learning before seats are bought. Every line describes the system as it runs today.

Where the database sits: Frankfurt
Passwords stored: 0
Breach notice to IMY: 72 h
Cookies, neither tracks: 2

PDF · GDPR Art. 28Data processing agreementTemplate ready to sign for company seats.Take one PDF · one pageSecurity sheetThe vendor questionnaire, answered.Take one PDF · one pageProcurement briefPrices, invoicing, SCORM, supplier details.Take one

Where the data lives

Database: Accounts, progress, answers, certificates and invoices sit in one Postgres database at Neon, in Frankfurt (AWS eu-central-1).
Server code: Runs on Vercel in Frankfurt (fra1). Pages and files are delivered from Vercel's global edge network.
Films: Streamed by Mux. The films hold no personal data; Mux sees the viewer's IP address and playback events while a film plays.
Email: Sent through Resend from the EU (Ireland).
Backups: Copies of the database are kept on an encrypted disk held by Kureos in Sweden. A second copy of each, encrypted with AES-256 before it leaves that disk, is kept for 35 days in a private GitHub repository; the key stays with Kureos, so GitHub holds only unreadable files.

Encryption

In transit: HTTPS only. Strict-Transport-Security is set for two years on every subdomain, and the server reaches the database over HTTPS.
At rest: Neon encrypts stored data and its backups with AES-256. Kureos's own backup copies sit on a disk encrypted with FileVault.
Secrets: Sign-in codes and session keys are stored only as SHA-256 hashes, so a copy of the database opens no one's account. No passwords exist to leak.

Who can get in

Learners: Sign in with a six-digit code sent to their address. A code lives ten minutes and allows five tries; requests are rate-limited per address and per IP address.
Sessions: A 32-byte random key in an HttpOnly, Secure, SameSite cookie, valid 90 days and ended at sign-out.
Buyers: A company's buyer sees only that company's seats, and only progress: never answers, choices or reflections.
Kureos staff: The admin pages open only to named addresses, through the same sign-in. Kureos's dashboard shows answers only as counts and percentages.
Links: Every link that acts without a sign-in is signed with HMAC-SHA256: leaving the founding list, turning reminders off, SCORM launches (ten minutes) and status checks (one day). Film streams are signed per film and expire after six hours.
The site: A strict Content-Security-Policy, framing refused, every database query parameterised, scheduled jobs locked behind a secret.
Infrastructure: Access to hosting, database, video and mail accounts is held by Kureos's founder alone.

When something goes wrong

Detection: Every server error is recorded and mailed to Kureos at once, at most once an hour per fault, so a broken route sends one message and keeps a full record.
A breach: Kureos contains it, assesses it and, where GDPR Article 33 requires, notifies the Swedish Authority for Privacy Protection (IMY) within 72 hours. People at high risk are told directly. Company customers are told without undue delay, and within 48 hours of Kureos becoming aware.
Report a fault: Security issues to kureos@kureos.com, subject "Security". Answered within two working days. The terms for good-faith research are under "Report a security problem" below.

Your people's rights

Ask: Copy, correction, deletion, restriction, objection and portability: write to kureos@kureos.com. Answered within one month.
Company seats: For the progress reports a company sees, the company is the controller and Kureos helps it answer its people. For a learner's own account and writing, Kureos is the controller.
Complaints: To IMY, imy.se, or the authority where the person lives or works.

SCORM and your learning system

The package: SCORM 1.2. It carries no course content: it opens the hosted course for the learner and reports back incomplete, completed, and passed with the score.
What it sends us: The learner id and name your system holds. An id that is not an email address becomes a private address of its own.
Control: The package is your organisation's key: it can launch learners into your seats and nothing else. A replacement can be issued if it leaks.

Accessibility

The aim: WCAG 2.2 at level AA.
Today: Every film carries English captions. The site follows the reduced-motion setting. On 5 Oct 2026 an automated axe check found no serious issue on any page or practice-room moment.
Known gaps: The films have English captions but no text transcript or audio description yet, and the PDF documents are not tagged for screen readers; each has a web page with the same content. The full statement is at learning.kureos.com/accessibility.

Processors

Every outside company that receives personal data from the site, read from the code's outbound calls and the browser's security policy. The exchange rate for Swedish VAT comes from Sveriges Riksbank; nothing about anyone is sent with that request.

Processor	Purpose	Location	Transfer basis
Vercel Inc.	Hosting: serves the site and runs its server code	Server code in Frankfurt (fra1); pages and files from Vercel's global edge network	US company. EU Standard Contractual Clauses in Vercel's data processing addendum; EU-US Data Privacy Framework.
Neon (Neon Inc.)	The database: accounts, progress, answers, certificates, invoices	EU: Frankfurt, AWS eu-central-1	Stored in the EU. US company: EU Standard Contractual Clauses in Neon's data processing addendum cover any access from outside the EU.
Mux, Inc.	Streaming the course films, and measuring playback quality (Mux Data)	United States, with global delivery	EU Standard Contractual Clauses in Mux's data processing addendum; EU-US Data Privacy Framework where certified.
Resend (Plus Five Five, Inc.)	Sending email: sign-in codes, course mail, invoices, founding-list letters	Sent from the EU (Ireland, AWS eu-west-1); US company	EU Standard Contractual Clauses in Resend's data processing addendum.
Google Workspace (Google Ireland Ltd)	The kureos@kureos.com mailbox: replies, requests and error alerts reach Kureos here	EU and US	EU Standard Contractual Clauses in Google's Cloud data processing addendum; EU-US Data Privacy Framework.

How long each record is kept

A job runs every day and deletes what has passed its time. Invoices stay for the period Swedish bookkeeping law sets, even when an account is deleted.

Record	Kept	Why
Sign-in codes	10 minutes, deleted on use; unused ones are gone within a day	A code is only a key for one sign-in.
Sessions	90 days from sign-in, deleted the day after they expire	So a weekly learner stays signed in, and no longer.
Your account, progress, answers, quiz attempts and certificates	While you hold a course; then 1 year after your last sign-in. Deleted at once when you delete the account	They are the course you bought. You can download or delete them at any time from your account page.
An account that never received a course	180 days	Anyone can sign in; an empty account has nothing worth keeping.
Founding list	Until the course launches and the founding-member price has closed (14 days after card checkout opens), then 30 days; if you leave first, 30 days after	To send the founding-price message you asked for, and to charge you the founding price at checkout.
Invoices, credit notes and sales	7 full years after the year of sale	Swedish bookkeeping law (Bokföringslagen 7 kap. 2 §). Kept even when an account is deleted.
Visit counts	Raw events 13 months, then daily totals	No cookies, no IP stored; the daily visitor hash cannot be traced back.
Error records	Details 90 days, the record 2 years	To find and fix faults.
Record of a deleted account	365 days, as a one-way hash of the address	So a restore from backup re-applies the deletion.
Backups	Nightly, 14 daily and 8 weekly copies, so at most about two months	To recover from a fault. Deletions reach backups as they rotate out.

Report a security problem

Where: Write to kureos@kureos.com with the subject "Security". English, please.
What to send: The page or address affected, the steps that show the problem, what an attacker could reach, and your name if you want credit. A short proof is enough: read only what you need to show it, and delete any personal data you came across once you have told us.
What we do: We reply within two working days to say we have it, keep you told while we fix it, and tell you when the fix is live. Please give us 90 days, or until the fix ships, before you publish.
Good-faith research: Research done in good faith is welcome, and Kureos will take no legal action over it. Good faith means: test against your own account, leave other people's data and the service itself as you found them, keep to learning.kureos.com, and tell us before anyone else.
Rewards: Kureos runs no bounty programme and pays nothing for reports. You have our thanks, and credit by name when we describe the fix, if you want it.

Contacts

Controller and supplier: Kureos World AB, organisation number 559223-5237, VAT SE559223523701, Sweden.
Privacy, security, procurement: kureos@kureos.com. Answered within two working days.
Supervisory authority: Integritetsskyddsmyndigheten (IMY), Stockholm, imy.se.
The policies: Privacy · Cookies · Terms of sale · Refunds. Updated 5 October 2026.