A practical overview of how we protect your account, your uploaded material, and the courses you generate.
Traffic to CourseIO is served over TLS (auto-issued via Let’s Encrypt at our deploy proxy).
YouTube access and refresh tokens are stored using column-level encryption, never in plain text.
We store a bcrypt hash of your password, not the password itself. Sign-in, one-time-code and password-reset endpoints are rate-limited per account and per IP address.
We don’t use your course content or uploaded material to train models for other companies.
Card entry happens inside Razorpay’s own Checkout widget or on Dodo Payments’ hosted checkout page — CourseIO’s servers never see or store your card details.
Found a security issue? Email security@courseio.ai and we’ll acknowledge it within one business day.
Last updated: October 13, 2026
The CourseIO application, its database and the courses it generates (videos, slides, exports) run on servers from Amazon Web Services EMEA SARL in Frankfurt, Germany (EU, eu-central-1), on encrypted volumes with daily backups. Uploaded source material is stored alongside them. Course generation sends parts of your content to the AI, voice and transcription providers listed on our subprocessors page; nothing else leaves that environment.
Application errors are reported to Sentry so we can fix problems quickly; those reports have passwords, one-time codes, tokens and payment signatures removed before they leave the server. The background-job dashboard and server access are restricted to named staff behind authentication.
Actions that commit your organization to money — subscribing, changing plan, canceling — are restricted to organization owners on the backend, not just hidden in the UI. Sign-in sessions use revocable tokens, so signing out (or a password change) actually invalidates them rather than leaving them valid until expiry.
If you believe you’ve found a security vulnerability in CourseIO, please email security@courseio.ai with details and steps to reproduce. Please don’t publicly disclose the issue until we’ve had a chance to investigate and respond. We don’t currently offer a paid bug-bounty program, but we credit researchers who report responsibly.
See our sub-processors page for the third-party services (payments, AI, transcription, voice, storage) that process data on our behalf.