Security your IT team can review, and your learners never notice.
LaserLMS is built for organisations that answer to auditors, clients and regulators. Here is how we protect the platform and the people who learn on it.
Least privilege
People and integrations get only the access their role needs, scoped to their company.
Data where you need it
Dedicated cloud in your region or on-premises inside your network.
Everything logged
Sign-ins, administrative changes and agent actions are recorded.
Patched promptly
Security updates for LaserLMS and its open-source components on a regular cycle.
Security controls
An overview for your IT and security teams. We go deeper during procurement.
| Identity and access | Single sign-on via SAML 2.0 and OpenID Connect; multi-factor authentication for local accounts; password policies; role-based permissions; company-scoped managers; session timeouts. |
|---|---|
| Application | Input validation and output escaping throughout; protection against cross-site request forgery; capability checks on every action; file type restrictions on uploads. |
| Data | HTTPS for all traffic; encryption at rest configured with your hosting choice; data export and deletion workflows; retention rules by data category. |
| Hosting | Managed cloud with backups and monitoring, dedicated instances in your chosen region, or on-premises under your controls. |
| AI features | AI providers you choose, called with your keys; material sent only for the request; AI features can be disabled entirely. |
| Integrations and agents | Scoped API and MCP tokens, read-only by default; optional human approval for write actions; full logging; revocable at any time. |
| Operations | Staging environments for changes; scheduled patching; logs of administrative actions; documented backup and restore procedures. |
| Open-source foundation | Built on a widely used open-source LMS core with a public security advisory process, so issues are found and fixed in the open. |
For procurement and security review.
We support enterprise buying processes and answer the hard questions directly, engineer to engineer.
- Security and vendor questionnaires completed
- Architecture and data flow documentation
- Data processing agreement and list of sub-processors
- Penetration testing on dedicated and on-premises deployments, with notice
Security questions
Something else? Ask us in a demo.
Will you complete our security questionnaire?
Yes. We complete security and vendor questionnaires during procurement and can provide architecture details, data flow descriptions and a data processing agreement.
Can we run penetration tests?
Yes, on dedicated and on-premises deployments, with notice and an agreed scope. Tell us about findings and we will work with you to fix them.
How do you handle security updates?
We track security advisories for LaserLMS and the open-source components it is built on, and apply patches on a regular schedule, or immediately for critical issues. On-premises customers receive the same patches with upgrade guidance.
Bring your security team to the demo.
We will answer questions about hosting, access control and data flows with an engineer in the room.
- Tailored to your use case, not a slide deck
- Cloud, dedicated or on-premises options explained
- Clear next steps and pricing for your scale