Security and data protection

• UK hosting. The platform runs on Microsoft Azure in the UK South region. Databases, files and backups stay in the UK.
• Your own database. Every association has its own database, separate from every other association's. One association's members can never appear in another's records.
• Encryption. Data is encrypted in transit (TLS) and at rest.

• No passwords held. Members sign in through their association's own login using OAuth 2.0 and OpenID Connect. Association staff sign in with one-time links sent by email. RiverCPD stores no passwords, so there are none to leak.
• Access by role. Members, managers, auditors, organisation administrators and scheme administrators each see only what their role allows. Organisation administrators see only their own organisation.
• Suspension is immediate. Suspend a member or an organisation and access stops at the next request.

• Processed in the EU, with names, emails, membership numbers and employers removed before anything is sent
• Never used to train a model
• Raw model responses kept 90 days for troubleshooting, then deleted
• Switched on per association, and members can opt out individually

• Roles: for an association's scheme, the association is the data controller and Senior Internet Ltd is the processor.
• Data processing agreement: a standard DPA with every association. Read the DPA.
• Sub-processors: published on our sub-processors page, with what each one does and where.
• Export: members can export their full record at any time. Associations can have all of their data on request.
• Deletion: members ask for their account to be deleted from the app, and the association decides. Once a record is deleted, it rolls off our backups within 90 days: incremental backups are kept for 30 days and full backups for 90.

We aim to meet WCAG 2.2 at level AA. Our accessibility statement says what we have designed for and what we still need to check.

• Cyber Essentials certified
• Report a security incident to security@rivercpd.com