Security and accessibility
How we guard your files and your learners.
Curriculum Builder security rests on plain, proven basics: HTTPS everywhere, signed-in access to the client console, hashed passwords, form tokens, signed messages between systems, and a strict file allow-list. Every course and this site follow WCAG 2.2 AAA. This page lists each practice in plain terms.
Accounts and access
Who can reach your course work.
Client work lives behind sign-in. Each role sees only the clients and courses it owns.
- Encrypted trafficEvery page and file loads over HTTPS. Browsers get a Strict-Transport-Security header, so they stay on HTTPS.
- Console sign-inThe client console requires an account. Passwords are stored as bcrypt hashes.
- Session cookiesCookies are HttpOnly, Secure, and SameSite Strict. The session ID changes at each sign-in.
- Form tokensEvery form that saves data checks a CSRF token tied to your session.
- Rate limitsPublic forms, course requests, and the AI tutor each cap how often one visitor can post.
- RolesPlatform admins, company admins, and trainees each get their own access level.
Your files
How source files move through the build.
Your uploads go to our server, then to our build machine over a signed channel. Finished courses come back the same way.
- File allow-listThe console accepts PDF, Word (DOCX), MP4, MOV, plain text, and Markdown. It skips every other file type.
- Signed messagesThe console and the build machine sign each message with a shared HMAC key. Each side drops any message that fails the check.
- SecretsAPI keys and database passwords live in a server file outside the public web folder.
- DatabaseDatabase queries use prepared statements.
- RemovalAsk us through the contact page and we remove your source files and course files from our systems.
Services we use
The AI services that see your content.
Each service sees the content it works on. Share source files you have the right to share, and leave out personal data about learners.
Anthropic (Claude)
Plans the course and writes every module.
Google (Gemini)
Reads long sources, checks facts, and powers the AI tutor.
OpenAI (Codex)
Runs the scripts that build each format.
HeyGen
Renders the avatar video for each module from its script.
Text to speech
Turns each module script into narration audio.
This website
Hardened pages for every visitor.
The public site loads scripts only from its own domain and one CDN with integrity hashes.
- Content Security PolicyA strict policy blocks inline scripts, framing, and outside script sources.
- Subresource IntegrityBootstrap loads from jsDelivr with a hash check, so a changed file fails to load.
- CookiesPages set a session cookie only where a form needs it.
- Private pathsConfig, include, backup, and log files return an error to the web.
- Report an issueSend security reports through the contact page. Our security.txt file lists the same route.
Accessibility
Built to WCAG 2.2 AAA, the highest level.
Every course passes an AAA accessibility gate before release. We hold this website to the same target.
Contrast and type
Body text meets 7 to 1 contrast. Large text meets 4.5 to 1. Text reflows at 200 percent zoom and at 320 pixels wide.
Captions and transcripts
Every video ships with captions. Every audio file ships with a transcript.
Keyboard and focus
Every control works by keyboard, with a clear focus ring and targets at least 44 pixels square.
Structure
Headings run in order, pages use landmarks, and a skip link jumps to the main content.
Plain language
Learner copy reads at grade 8 or lower, with terms defined on first use.
Calm motion
The site honors your reduced-motion setting and keeps motion short.
Found a barrier? Tell us through the contact page. Name the page and what got in your way, and we reply within one business day.
See a sample course in your topic.
Tell us what you teach and who learns it. We reply within one business day with a sample course and a plan for your build.