Security at NDT Academy

NDTAcademy.com, LLC

Effective Date: July 4, 2026

1. Why Security Is the Product

Our certificates are audit evidence. That only works if the records behind them cannot be forged, altered, or leaked, so the Platform is built around record integrity and data protection.

2. Data Protection

All traffic is encrypted in transit (TLS 1.2+, HSTS-enforced HTTPS); data is encrypted at rest at the database layer (AES-256). Passwords are hashed with bcrypt by Supabase Auth, never stored or visible in plain text. Payment card data is handled entirely by Stripe (PCI DSS Level 1); it never touches our servers. Government-ID images used for identity verification are captured and stored by Persona, not by us.

3. Access Control

Every database table enforces row-level security: students see their own records, company admins see only their roster, and platform administration is limited to named staff under least-privilege roles. Administrative service credentials exist only server-side and are never shipped to browsers.

4. Record Integrity

Training evidence (time logs, quiz and exam attempts, identity checks) is append-only at the database level. Issued certificates are immutable, even administrators can only revoke (with a recorded reason), never edit or delete, and every certificate is publicly verifiable at /verify-certificate. Privileged actions are recorded in an append-only audit log with actor, action, affected record, before/after values, IP, and timestamp.

5. Application Security

Security headers including a Content-Security-Policy, HSTS, and frame protections; signed and verified payment webhooks with idempotent fulfillment; server-side re-verification of identity results (client claims are never trusted); rate limiting on sensitive endpoints; and dependency review as part of our change-management process.

6. Reporting a Vulnerability

We welcome good-faith reports: email security@NDTAcademy.com (see /.well-known/security.txt). Please include steps to reproduce and avoid accessing other users’ data. We acknowledge within 2 business days, and we will not pursue good-faith researchers who respect user privacy and service availability.

7. Incident Response

We maintain a written incident-response and data-breach notification procedure. If an incident affects your personal information, we will notify you and applicable regulators as required by law, and publish a post-incident summary where appropriate.

Contact

Questions about this policy may be directed to:
NDTAcademy.com, LLC, Attn: Legal
Email: legal@NDTAcademy.com