Security at CourseIO
A practical overview of how we protect your account, your uploaded material, and the courses you generate.
Encryption in transit
Traffic to CourseIO is served over TLS (auto-issued via Let’s Encrypt at our deploy proxy).
OAuth tokens encrypted at rest
YouTube access and refresh tokens are stored using column-level encryption, never in plain text.
Passwords are never stored
We store a bcrypt hash of your password, not the password itself. Sign-in, one-time-code and password-reset endpoints are rate-limited per account and per IP address.
Your content stays yours
We don’t use your course content or uploaded material to train models for other companies.
Payments handled by Razorpay
Card entry happens inside Razorpay’s own Checkout widget — CourseIO’s servers never see or store your card details.
Responsible disclosure
Found a security issue? Email security@courseio.ai and we’ll acknowledge it within one business day.
Last updated: 15 September 2026
Where your data lives
The CourseIO application, its database and the courses it generates (videos, slides, exports) run on servers from Amazon Web Services EMEA SARL in Frankfurt, Germany (EU, eu-central-1), on encrypted volumes with daily backups. Uploaded source material is stored alongside them. Course generation sends parts of your content to the AI, voice and transcription providers listed on our subprocessors page; nothing else leaves that environment.
Monitoring
Application errors are reported to Sentry so we can fix problems quickly; those reports have passwords, one-time codes, tokens and payment signatures removed before they leave the server. The background-job dashboard and server access are restricted to named staff behind authentication.
Access control
Actions that commit your organization to money — subscribing, changing plan, cancelling — are restricted to organization owners on the backend, not just hidden in the UI. Sign-in sessions use revocable tokens, so signing out (or a password change) actually invalidates them rather than leaving them valid until expiry.
Reporting a vulnerability
If you believe you’ve found a security vulnerability in CourseIO, please email security@courseio.ai with details and steps to reproduce. Please don’t publicly disclose the issue until we’ve had a chance to investigate and respond. We don’t currently offer a paid bug-bounty program, but we credit researchers who report responsibly.
Sub-processors
See our sub-processors page for the third-party services (payments, AI, transcription, voice, storage) that process data on our behalf.