Security and trust

This page summarises how Workflow Academy is secured and where to find the underlying documents. It separates controls that are implemented today, dependencies the operator must configure, and assurances we do not claim. Workflow Academy is operated by Grand Cayman Group Ltd. and is independent professional training — not affiliated with, endorsed by, or certified by OpenAI.

• Application data protected by row-level security policies, with forced row-level security on the tenant and control-plane surfaces where it is configured.
• An explicit role and capability model (student, instructor, content editor, administrator, maintenance service) enforced in the interface, in server functions, and in database policies, with roles stored separately from profiles.
• Server-authoritative decisions for enrolment, grading, completion, publication, certificates, roles, and entitlements.
• Quiz answer keys and explanations are withheld from the browser until an attempt is resolved under the assessment policy; scoring happens server-side.
• Private files delivered only through short-lived signed URLs issued after a server-side authorisation check.
• Mandatory audit records for role changes, enrolment and entitlement changes, publication and rollback, certificate actions, payment actions, and destructive actions.
• No standing platform-administrator access into organization data; support access is time-boxed and visible to the tenant.
• Signature-verified, replay-resistant, idempotent payment webhooks. We never store card data.
• Optional per-user multi-factor authentication, plus organization-level authentication policy with session maximum-age and idle timeout.
• Administrator-operated data erasure and anonymisation, and learner self-service data export.
• The repository defines automated quality workflows and gates — type checking, linting, unit tests, database security assertions, and accessibility checks. Whether a given run executes depends on operator-controlled continuous-integration capacity, so we do not present current results as an assurance.

Some capabilities are implemented in the platform but depend on deployment configuration that the operator controls:

• Transactional email requires live provider credentials; until then, queued messages are not delivered to recipients.
• Scheduled background work (reminders, report delivery, outbox drain, expiry sweeps) requires an external scheduler to call the drain endpoint.
• Hosting region and payment mode are deployment settings. Payments remain in test mode until the operator approves live processing.

We list these openly rather than presenting them as delivered controls.

We hold no SOC 2, ISO 27001, PCI DSS, or HIPAA attestation, we have not commissioned an independent penetration test or accessibility audit, and we publish no uptime commitment, recovery-time objective, or backup guarantee, and we publish no VPAT or Accessibility Conformance Report. If any of these become available, this page will be updated with the evidence.

Report suspected vulnerabilities to info@grandcaymangroup.com with enough detail to reproduce the issue. Please avoid accessing other people's data, degrading the service, or making changes to records while testing. We will acknowledge your report and keep you informed while we investigate.

• Privacy Notice
• Terms & Conditions
• Refund Policy — refunds are handled by Paddle, our merchant of record
• Data Processing Addendum
• Subprocessor list
• Accessibility statement

Grand Cayman Group Ltd. · info@grandcaymangroup.com