Security and data residency
Bodhih Training Solutions Private Limited · Last updatedIn short
Bodhih LMS keeps its database in India (Mumbai). Files are held in Cloudflare R2 object storage and served through Cloudflare. The application runs on Railway and Vercel. We list every provider that touches customer data below, say plainly what we have and what we are still working towards, and give every company a way to export its data. We do not sell personal data and customer data is not used to train AI models.
Where your data is stored
All customer records - people, enrolments, progress, assessment answers and scores, competency readings, certificates, xAPI statements and audit logs - are stored in a PostgreSQL database hosted by Supabase in the Mumbai region (ap-south-1), India.
Uploaded files (SCORM packages, documents, video, audio) are stored in Cloudflare R2 object storage and delivered through Cloudflare’s network. Web pages and the API are served from Vercel and Railway; requests are processed on their servers and not stored there.
Data residency outside India (a database in the EU or the US for one company) is not offered yet. It is on the roadmap; Enterprise customers who need it should tell us so we can scope it with them.
Subprocessors
Providers that process customer personal data on our behalf:
| Provider | What for | Data location |
|---|---|---|
| Supabase | Primary database | India (Mumbai) |
| Cloudflare | File storage (R2), content delivery, DNS and security | Global network |
| Railway | Runs the Bodhih API | Processing only |
| Vercel | Runs the bodhih.org web application | Processing only |
| Brevo | Transactional email (sign-in, assignments, reminders, certificates) | European Union |
| Razorpay, Stripe | Payments (card and bank details stay with them) | India, global |
| Anthropic | AI features: course authoring assist, simulation narration and AI counterparts. Not used to train models. | United States |
| AssessAll (Bodhih group) | Diagnostic and certification assessments inside pathways | India |
How data is protected
- Encryption in transit (TLS) for every connection; database and file storage encrypted at rest by the providers.
- Passwords are stored only as bcrypt hashes. API keys and directory (SCIM) tokens are stored only as SHA-256 fingerprints and shown once. Webhook signing secrets and LRS credentials are encrypted with AES-256-GCM.
- Every company’s data is separated by company; administrators see only their own company and its branches.
- Single sign-on with OpenID Connect (Entra ID, Okta, Google Workspace) and SCIM 2.0 deprovisioning, so a leaver loses access when your directory says so.
- An audit log of sign-ins, role changes, assignments, publications, withdrawals and integration changes, each with actor and time.
- SCORM and media files are served through signed, short-lived links checked against the learner’s enrolment.
- Rate limiting on every API, per key for integrations, and bot protection on sign-up.
- Outbound webhooks and LRS forwarding are restricted to public HTTPS addresses and are signed, so they cannot be used to reach internal systems.
Certifications and what is in progress
Bodhih follows India’s Digital Personal Data Protection Act, 2023, and has a Grievance Officer (see the privacy policy).
We do not yet hold SOC 2 or ISO 27001 certification, and say so rather than implying it. Both are on the published roadmap, together with two-factor sign-in for Bodhih accounts and a WCAG 2.2 AA accessibility audit with a published VPAT. Customers who need a security questionnaire answered can write to solutions@bodhih.com.
Your data, your copy
Company administrators can export people, enrolments, completions and certificates through the public API, download every xAPI statement from Settings → Integrations, and forward statements to their own Learning Record Store in real time.
When a contract ends, the company can ask for a full export and then for deletion. Backups containing deleted data age out within 7 days.
Reporting a security issue
Write to solutions@bodhih.com with the subject “Security”. Please give us a reasonable time to fix an issue before making it public. We do not take legal action against good-faith research that avoids privacy violations and service disruption.