FULLPASS Trust Center
Request a security review

Trust Center

Everything a customer, or their security and procurement team, might reasonably ask about how FULLPASS handles their courses and their data — in one place, written from what the system actually does.

info@fullpass.ai Privacy Policy Security overview Security questionnaire
Overview Documents Controls Subprocessors Updates

Overview

The four things that most often decide a security review.

Course files are never storedPackages are analysed in memory and discarded when the scan ends. Only the report is kept, with a picture of each problem.
Hosted in the European UnionApplication and database in Amsterdam, Netherlands, encrypted at rest and reachable only from the application.
No content leaves our serversText and speech inside your videos are read on our own machines, not by an external AI service.
Retention is enforced, not promisedReports are deleted automatically. Trial 30 days · Solo 180 days · Studio 365 days · Team 365 days.

Documents

Open access — nothing here is gated behind a request form.

Terms of ServiceThe agreement between you and FULLPASS. Privacy PolicyWhat we collect, why, and how long we keep it. Data Processing AgreementFor customers who need a processor agreement in place. Refund and Cancellation PolicyHow to cancel, and when we refund. SecurityHow FULLPASS is built and what protects your data. SubprocessorsEvery third party that touches customer data. Service Level AgreementWhat we commit to on paid plans, and what happens if we miss it. Security QuestionnaireThe answers procurement usually asks for, ready in advance.

Controls

Implemented today. Anything on the roadmap rather than in the product is marked as such on the security questionnaire.

Infrastructure

  • Application and database hosted in the European Union
  • Database encrypted at rest and reachable only from the application
  • Daily database backups by the hosting provider, kept 6 days, and our own encrypted copy every night, kept 7 days
  • HTTPS everywhere, with HSTS and an automatic redirect from HTTP
  • External uptime monitoring; errors raise an alert to the team

Access control

  • Passwords hashed with bcrypt at cost factor 12, never stored or logged in the clear
  • A code sent to the account's email is needed to sign in on a new browser
  • Minimum ten characters, with common passwords rejected
  • Sessions held in an httpOnly, sameSite, secure cookie
  • Every other session is revoked when a password changes
  • Sign-in cannot be used to discover who holds an account
  • Role-based visibility — members see their own reports, managers see the organisation’s
  • Staff access limited to the three named operators of the platform

Product security

  • Content Security Policy, X-Frame-Options, X-Content-Type-Options, Permissions-Policy and Referrer-Policy
  • Parameterised SQL throughout; upload type and size limits; output escaped
  • Rate limiting on the endpoints that send mail
  • Stripe webhooks verified against their signature before being acted on
  • Card details never reach our servers — payment is taken on Stripe’s hosted page
  • Over 300 automated end-to-end checks across accounts, sign-in, billing, administration, sharing and the analysis engine run before every change ships
  • Pure-JavaScript dependencies, kept deliberately few

Data and privacy

  • Course files are held in memory for the life of the request and never written to disk
  • Text and speech inside videos are analysed on our own servers — no content is sent to any external AI service
  • Product analytics are first-party: no cookie, no device identifier, no IP address, and no third-party analytics service
  • Reports are deleted automatically at the end of the plan’s retention window (Trial 30 days · Solo 180 days · Studio 365 days · Team 365 days)
  • Customers can export everything we hold without contacting us
  • Customers can delete their account and all its data without contacting us
  • Shared report links expire after 30 days, and sharing can be stopped at any time
  • Subprocessors published, with 30 days’ notice before the list changes
  • Security incidents notified within 72 hours of our becoming aware

Subprocessors

The only third parties involved in running FULLPASS. None of them ever receives a course file. We give 30 days' notice before adding one — see the full list.

Stripe

Payments, invoices, billing portal

Data processed
Name, email, billing address, card details (entered directly with Stripe — never through us)
Region
US / EU
Resend

Transactional email — confirmations, sign-in codes, invitations, alerts

Data processed
Recipient name and email, message content
Region
US / EU
SMTP2GO

Backup transactional email, used only if Resend cannot send

Data processed
Recipient name and email, message content
Region
EU
Brevo

Second backup transactional email, used only if Resend and SMTP2GO both cannot send. In use from 5 December 2026

Data processed
Recipient name and email, message content
Region
EU
Railway

Application hosting and the Postgres database

Data processed
All stored account data and reports
Region
European Union
Cloudflare

DNS, and TLS for fullpass.ai

Data processed
Connection metadata only
Region
Global

Updates

Changes to anything published on this page.

Security

Our nightly copy of the database is kept inside FULLPASS

Published 6 November 2026

Every night we still make our own copy of the database, encrypted with AES-256-GCM. We now keep it inside FULLPASS for 7 days, where only the platform's operators can download it, instead of emailing it to ourselves and keeping it 30 days. Copies emailed before this change are deleted within 30 days of being made. The hosting provider's own daily backups, kept 6 days, are unchanged.

Subprocessors

Brevo joins as a second backup for email

Published 3 November 2026

From 5 December 2026, if Resend and SMTP2GO both cannot send an account email (a sign-in code, a confirmation, an invitation or an alert), Brevo will send it instead. Brevo receives the recipient's name and email address and the message, never a course file, and keeps its data in the EU. Our Data Processing Agreement promises 30 days' notice before a subprocessor is added, so Brevo carries no mail before then. To object, write to info@fullpass.ai.

Security

Backups described exactly as they are

Published 22 October 2026

The database is backed up every day by our hosting provider, and each backup is kept 6 days. Every night we also make our own copy, encrypted with AES-256-GCM, and keep it outside the hosting provider for 30 days. Earlier wording mentioned point-in-time recovery, which is not offered, so it has been removed.

Reports

Reports now include a picture of each problem

Published 20 October 2026

Every report now keeps a picture of the slide, page or video frame each finding is about, with the problem outlined, so it can be seen without opening the course. The pictures are stored with the report and deleted with it, on the same retention schedule. Course files themselves are still never stored.

Trust Center

Trust Center published

Published 23 September 2026

This page, the eight documents behind it and the self-service export and deletion tools went live together. Retention windows are now enforced automatically rather than being a stated intention.

Questions, or reporting a vulnerability

For a security review, a signed DPA naming your organisation, or a completed copy of your own questionnaire, email info@fullpass.ai.

To report a vulnerability, email the same address with "Security" in the subject. We acknowledge within two working days and will not pursue anyone acting in good faith.