Security at OpenFormations
The security of your data and your learners' data is our absolute priority.
Architecture
| Component | Technology | Hosting |
|---|---|---|
| Application | Next.js (Vercel) | Global Edge |
| Database | PostgreSQL (Supabase) | Europe (AWS eu-west) |
| File storage | Supabase Storage | Europe |
| Payments | Stripe | Europe |
| CDN | Vercel Edge Network | Global |
Authentication
- Passwords hashed with bcrypt (cost 12)
- JWT sessions with automatic rotation
- Brute force attack protection
- Automatic expiration of inactive sessions
Encryption
- In transit: TLS 1.3 (HTTPS) on all connections
- At rest: AES-256 for stored data
- Payments: processed by Stripe (PCI DSS Level 1)
Access control
OpenFormations uses PostgreSQL Row Level Security (RLS):
- Each trainer can only see their own data
- Each learner can only see their courses
- Data cannot be accessed by other users
Backups
- Automatic daily backups
- 30-day retention
- Real-time replication for high availability
Compliance
- GDPR: compliant (data hosted in Europe)
- HTTPS: mandatory on all endpoints
- Cookies: strictly necessary only
Questions about security? Contact us at contact@openformations.com.
