No SOC 2 report or ISO 27001 certificate
ColPort holds neither. If your procurement asks for one, ask us what we can show instead: this page, our Data Processing Agreement and our record of processing activities.
Trust center
Hosting, sub-processors and security, in one place
What is in place today, stated plainly. If your procurement or data protection team needs something this page does not answer, write to security@colport.io.
Last updated: 10 October 2026
Last updated: 10 October 2026
Where we stand
What we hold, and what we don't
Hosted in Germany
Hall and Inn run on a Hetzner server in Germany: the application, the database, file storage and background jobs. Some services outside the EU take part, such as email delivery and the default AI model. The sub-processor list below names each one and when it is used.
GDPR / AVG
A learner can download their data and ask for its erasure on their own My data page. Organisation admins can read ColPort's record of processing activities (GDPR Art. 30) in Hall's compliance settings.
AI infrastructure
Which AI powers ColPort — and where it runs
Anthropic (Claude) — default
Our default AI provider, in the United States, under Anthropic's data processing terms and the EU Standard Contractual Clauses. Anthropic does not use data sent through its API to train its models.
Mistral (EU) — data-residency option
Each organisation can switch its AI to Mistral, which processes inside the EU (France). Semantic search then uses a built-in method instead of Voyage AI, so the organisation's text does not go to the US. Switch it in Admin → AI settings.
What is removed before the model sees it
Before text reaches an AI provider, email addresses, phone numbers, IBANs, card numbers and BSN-like numbers in it are replaced with placeholders. Names are not removed, so what a person types into an assistant reaches the provider.
AI never scores or grades
AI only drafts content for human review. All assessment scoring, pass/fail, completion, and compliance reporting are computed deterministically from the SCORM / xAPI results and analysed by a person — the AI makes no measurement decisions.
AI is opt-in, and recorded
Every AI feature sits behind an explicit org-level opt-in, recorded with a DPIA attestation (GDPR Art. 35). Content-provenance labelling for AI-drafted material is in development; we don't mark drafted content yet, and we'd rather tell you that than imply otherwise.
Technical + organisational measures
Annex II of the DPA, summarised
Encryption
HTTPS only, with HSTS. Phone numbers are stored AES-256 encrypted with their own key. SSO client secrets and Mill keys are stored AES-256-GCM encrypted. Passwords are stored as bcrypt hashes.
Separation between organisations
Every query is scoped to your organisation in the application. The database does not check this a second time.
Hash-chained audit log
Compliance events are written to a hash chain per organisation. Changing or deleting a row breaks the chain, and an admin can verify the whole chain at any time.
Health checks and error reports
A health check reports the state of the database and Redis. Error reports go to Sentry when it is switched on, with email addresses, IP addresses and cookies removed first.
Sub-processors
The 10 sub-processors
Every outside service the platform's code can send personal data to, and when it does. A service that is not switched on for this deployment receives nothing.
| Service | Personal data it receives | Where | Used when |
|---|---|---|---|
Hetzner Hetzner Online GmbH The server Hall and Inn run on: the application, the database, file storage and background jobs. | Everything the platform holds. | Germany Inside the EU | Always. |
Resend Resend, Inc. Sends the platform's emails. | The recipient's name and email address, and the email itself. | United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914) | When this deployment sends email. |
Anthropic (Claude) Anthropic PBC Writes AI drafts and answers the AI assistants. | The text sent to an AI feature: prompts, course material and what a person types. Email addresses, phone numbers, IBANs, card numbers and BSN-like numbers are replaced first; names are not. | United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914) | When an organisation has AI switched on and its AI provider is Anthropic, the default. |
Mistral Mistral AI SAS Writes AI drafts and answers the AI assistants, inside the EU. | The text sent to an AI feature, with the same numbers and addresses replaced first. | France Inside the EU | When an organisation chooses Mistral as its AI provider. |
Voyage AI Voyage AI Turns course text into search vectors for Inn's search and the course coach. | Course text, and the questions learners ask the course coach. | United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914) | When semantic search is switched on, and only for organisations whose AI provider is Anthropic. |
Google Cloud Translation Google Cloud EMEA Limited Translates course text by machine. | The course text being translated. | United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914) | When machine translation is switched on. |
CM.com CM.com Netherlands B.V. Sends text messages. | The phone number and the message. | Netherlands Inside the EU | When an organisation sends training by text message. |
Twilio Twilio Inc. Sends a text message when CM.com cannot. | The phone number and the message. | United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914) | When CM.com is not set up or cannot send a message. |
Sentry Functional Software, Inc. Collects error reports so we can fix faults. | Technical details of an error. Email addresses, IP addresses and cookies are removed before a report is sent. | United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914) | When error reporting is switched on. |
Stripe Stripe Payments Europe, Limited Takes payments for Inn courses and subscriptions. | The buyer's name, email address and payment details. | Ireland Data may leave the EU, under the EU Standard Contractual Clauses (2021/914) | When someone pays for an Inn course or subscription. |
We tell customers 30 days before we add or replace a sub-processor, and you can object within that time.
Not on this list: your organisation's own sign-in provider, which your organisation chooses; videos your organisation embeds from YouTube or Vimeo, which load only when a learner presses play and which your organisation's privacy notice names; and browser push services, which carry a push message encrypted so they cannot read it.
Responsible disclosure
Report a security issue
We welcome coordinated disclosure from security researchers. Write to security@colport.io with a description and the steps to reproduce it. We do not take legal action against researchers who act in good faith and give us time to fix the issue before publishing it.
Documents
What we can send you
Data Processing Agreement
Our standard DPA under GDPR Art. 28, with the EU Standard Contractual Clauses for the transfers the sub-processor list names. Ask dpo@colport.io.
Record of processing activities
ColPort's record of processing activities (GDPR Art. 30). Organisation admins can read it in Hall's compliance settings.