Personal data protection
OpenFormations complies with the General Data Protection Regulation (GDPR) and takes the security of your data very seriously.
Data hosting
| Data | Hosting | Location |
|---|---|---|
| User accounts | Supabase (AWS) | Europe (eu-west) |
| Files and videos | Supabase Storage | Europe |
| Payments | Stripe | Europe |
| Emails | EU provider | Europe |
Data collected
OpenFormations only collects necessary data:
- Trainers: name, email, organization name
- Learners: name, email, course progress
- Payments: processed by Stripe (OpenFormations does not store banking data)
User rights
In accordance with the GDPR, your learners have:
- Right of access: view their data
- Right of rectification: correct their information
- Right of erasure: delete their account and data
- Right of portability: export their data
- Right to object: unsubscribe from communications
Data deletion
Upon account deletion:
- Personal data is deleted within 30 days
- Anonymized data (aggregated statistics) is retained
- Issued certificates remain verifiable
Technical security
- TLS encryption in transit
- AES-256 encryption at rest
- Secure authentication with bcrypt hashing
- Role-based access restriction (Row Level Security)
Questions about data protection? Contact us at contact@openformations.com.
