Skip to main content
Security at Campus is something we test continuously, not a box we check once.

​
Continuous security checks

We run automated security checks every day, probing the platform for weaknesses so we can fix them before they reach production. Dependencies are monitored for known vulnerabilities (Dependabot) and patched promptly.

​
Monitoring

Errors are reported to our team directly through error monitoring (Sentry), with personal data suppressed from those reports.

​
Activity logging

We log key actions: sign-ins, AI generations, lesson completions, credential changes, and exam attempts. This lets us establish who did what. It is operational and security logging, not a manager-facing surveillance feature, and not a tool for performance monitoring of individual learners. Access to these logs is restricted to our own team.
For German works-council review: coaching conversation content is not part of activity logs. See AI and your data for conversation privacy.

​
Incident response

We are a small, dedicated team and act immediately when we detect a security incident: we identify, contain, assess, and remediate it, and document what happened. If a personal-data breach affects your data, we notify you without undue delay, and within 72 hours of becoming aware. Our external Data Protection Officer is involved in assessing and handling breaches.

​
Application security

Campus is built on a modern, actively maintained web framework. All data changes are processed and validated server-side, so the integrity of a change never depends on the browser. Secrets and credentials are kept server-side and are never exposed to the browser.