Least necessary access
Access should be limited to authorised people and legitimate tasks.
Purpose-led handling
Information should be used for defined learning, support and administration purposes.
Accountability
Security responsibilities should be understood across the Academy, learners and service providers.
Evidence before claims
Detailed technical controls should be confirmed against the live implementation.
1. Scope
This page summarises the security and information-handling approach for the Rofane Academy website and LMS. It is intentionally high level: detailed technical claims about infrastructure, encryption, backup frequency, recovery objectives, penetration testing, certifications or subprocessors should be verified against the current environment before being relied on.
2. Security principles
The Academy aims to apply reasonable safeguards proportionate to the information and services being handled, including appropriate access management, secure configuration, operational controls, monitoring and incident response.
3. Identity and access
Accounts are intended for authorised users. Learners are responsible for protecting passwords and authentication information. Administrative and support access should be limited according to role and operational need.
4. Data handling lifecycle
Information may be collected during registration, enrolment, learning activity, assessment, certificate generation, support and organisation training. Records should be handled according to their purpose, sensitivity, contractual requirements and applicable retention obligations.
5. Hosting and service providers
The Academy may rely on infrastructure, email, analytics, payment, video, storage or other technology providers. Current provider and hosting details should be confirmed from the live environment and applicable agreements before being represented as fixed commitments.
6. Logging and monitoring
Application, authentication, diagnostic and infrastructure logs may be generated for operations, troubleshooting, security and audit purposes. Access to logs should be controlled and retention should be proportionate to the operational purpose.
7. Backups and continuity
Backup and recovery arrangements are operational controls and may vary by environment. Current schedules, storage locations, recovery objectives and testing status should be verified against the production configuration and deployment procedures.
8. Security incidents
Suspected security or privacy incidents should be investigated, contained and escalated according to their severity. Where notification is legally or contractually required, the relevant process should be followed.