Security

Last updated: October 2026

Governing Idea is built with a minimal‑data, privacy‑first architecture. We collect as little personal information as possible and use modern infrastructure to protect it. This page outlines the core security practices we follow to safeguard your data.

Our security practices

• HTTPS enforced across all pages and API routes.
• Data minimization — we collect only what is necessary to operate the service.
• No analytics, and no advertising or tracking cookies.
• Hosting and infrastructure provided by the vendors listed on our Subprocessors page.
• Access controls for internal systems and administrative tools.
• Breach notification without undue delay if personal data is affected.

How accounts and usage are protected

• Sign-in links are confirmed on our server. A password-reset or invitation email carries a one-time code. Our server exchanges that code for your session; we never accept a login carried in the link itself. A password-reset link works only in the browser that requested it.
• You can change only your own name. Everything else on your profile, such as your role, your organization and your acceptance of our terms, is changed only by our server or an administrator, and our database enforces this, not just our app. Names are limited to 80 characters.
• Administrative functions are restricted. Only administrators and our own server can create organizations, and learners can't look up another person's administrator status or group membership.
• Usage limits fail safe. Each account has a daily limit on AI checks. If we can't confirm how many checks you've used today, the check is refused, not run.

Subprocessors

A current list of our subprocessors, and what each one processes, is on our Subprocessors page.

Data protection terms

For contractual data protection terms, including our obligations as a data processor under GDPR Article 28, review our Data Processing Addendum.