How is my data stored and secured?

All data flows over encrypted HTTPS connections. At rest, sensitive fields (license numbers, payment tokens, login credentials) are encrypted in our database. Access is restricted to staff who need it for support and compliance, with audit logs on every access. We run regular vulnerability scans, penetration tests, and follow industry-standard security practices for online education platforms handling regulated data. If a breach ever occurred, we would notify affected users within the timeframes required by state law.

The security architecture follows a defense-in-depth pattern: encryption at the transport layer, encryption at the storage layer, role-based access at the application layer, and audit logging across every layer. A breach at any single layer doesn't expose data because the next layer adds independent protection. This contrasts with a flat-architecture approach where a single compromised credential could expose everything; the multi-layer approach contains the blast radius of any single incident. Staff access is also segmented by role — support agents see contact info but not full payment data, compliance staff see completion records but not in-progress course content.

Independent assessment is a meaningful part of the security practice rather than a one-time event. Our payment processor is audited annually by external assessors, the platform itself is reviewed for application-layer vulnerabilities on a recurring schedule, and infrastructure is monitored continuously for anomalous patterns. The combination of preventive controls and active monitoring is what real security looks like in practice — not a static list of features but an ongoing process. Drivers concerned about specific aspects of the security posture can request our security overview document, which describes controls in more detail than fits into a help-center entry.