Trust & Security

This page is maintained by CPE Zone to answer common security and privacy questions about the platform. It describes the controls currently enabled for the service. It is not a certification, audit report, or independent verification, and it does not modify the Terms or Privacy Policy.

1. Access & authentication

• Sign-in is delegated to LinkedIn OAuth. CPE Zone never sees or stores your LinkedIn password.
• Sessions are managed by our authentication provider with refresh-token rotation and automatic expiry.
• Administrative areas (course authoring, compliance, audit log, user management) are gated by server-validated roles. Roles are stored in a dedicated table and checked via a security-definer function on every privileged call.
• Row-Level Security is enabled on user-owned tables (profiles, enrollments, completions, assessment attempts, evaluation responses, seat-time events). Policies scope reads and writes to the signed-in user.

2. Hosting & platform

• The application runs on Lovable Cloud, which provides managed Postgres, authentication, storage, and edge compute. Data is stored in encrypted, managed infrastructure.
• Server logic runs in serverless workers; secrets (API keys, service-role credentials) are injected at runtime and are never exposed to browser code.
• Traffic to the application is served over HTTPS/TLS.

Lovable Cloud is the underlying platform; this is a factual statement of the hosting stack, not a Lovable certification of CPE Zone.

3. Data we collect & how it’s used

For the full list of categories and purposes, see the Privacy Policy. In summary:

• Account & identity — name, email, headline, profile photo, LinkedIn URL, optional professional credentials and license details.
• Learning records — enrollments, slide progress, seat-time events, assessment attempts, completions, certificates, CPE credits.
• Operational telemetry — login events (timestamp, IP, coarse geolocation) used for fraud and support investigation; admin-only.

4. Subprocessors & integrations

• LinkedIn — OAuth sign-in and optional sharing of completion certificates that you initiate.
• ElevenLabs — text-to-speech narration generation for course slides. Course narration scripts are sent at build time; learner data is not.
• Lovable AI Gateway — AI assistance used by content creators to draft and revise course content. Learner identifiers are not sent.
• Email & notifications — transactional email delivery for account, completion, and operational notifications.
• IP geolocation — used only to enrich admin login-event records for fraud review.

5. Storage & encryption

• Data at rest is stored in managed, encrypted database and object storage.
• Data in transit is protected with TLS.
• Narration audio and generated video assets are stored in private buckets with signed, time-limited URLs issued only to authorized requests.

6. Retention

• NASBA records. Course content, assessment questions, evaluation responses, completion records, and audit logs are retained for at least five (5) years from the last delivery date of each course version, in line with NASBA Registry requirements.
• Account data. Retained while your account is active and for a reasonable period after closure to support certificate verification and regulatory audit.
• Operational logs. Login events and audit logs are retained as needed for security and compliance review.

7. Privacy requests

You can review, export, correct, or delete your personal data by emailing the address below. We may retain records that are required to meet NASBA, tax, or other regulatory obligations, and will explain what is kept and why. See the Privacy Policy for the full request process.

8. Vulnerability reporting

If you believe you have found a security vulnerability, please email admin@cpezone.com with the subject line “Security report”. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.

9. Incident contact

For suspected account compromise, certificate fraud, or data-handling concerns, contact admin@cpezone.com. We will acknowledge receipt and work with you on next steps.

10. Compliance posture

• CPE Zone operates as a CPE program designed against the NASBA/AICPA Statement on Standards for Continuing Professional Education Programs, including the 2024 Nano Learning standards (10-minute minimum, 100% pass mark, rationale on every question, evaluation, and audit retention).
• CPE Zone is not currently SOC 2, ISO 27001, HIPAA, or PCI certified. The platform is not designed to process Protected Health Information; if your organization requires a Business Associate Agreement, see the BAA.
• Statements about specific certifications, attestations, or regulatory frameworks will only be added here once the underlying evidence exists.

11. Shared responsibility

Security is shared between Lovable Cloud (the underlying platform), CPE Zone (the application owner), and you (the user). You are responsible for protecting your sign-in credentials, keeping your contact details current so you receive security notices, and using the service in line with the Terms.

12. Changes

We may update this page as the platform evolves. Material changes will be reflected in the “Last updated” date above.