Security

Transport security

All pages, conversations, and embeds are served exclusively over HTTPS with automatically managed TLS certificates.

Access model

Creator accounts are protected by email + password (stored as salted hashes) with secure, HTTP-only session cookies. Learner sessions use private, unguessable link tokens — learners never create accounts or passwords, and each session is scoped to its own access token.

Content handling

Uploaded documents and learner transcripts are used solely to deliver the learning experience. Content is processed by our AI provider (Anthropic) to generate Laura's teaching and by speech services for voice — it is not used by us to train AI models and is never sold. See the Privacy Policy for details.

Payments

Subscriptions are processed by Stripe. Card details never touch our servers.

Retention and deletion

Deleting a learning conversation removes its sessions and transcripts. Account and data deletion requests are honored within 30 days: security@pentext.com.

Embedding and corporate allowlisting

To embed conversations inside corporate tools, your IT team may need to allowlist our domain:

learnwithlaura.ai (HTTPS, port 443) — required for SharePoint's HTML Field Security list, intranet iframe policies, and restrictive corporate firewalls. Learner sessions also connect to our speech services over HTTPS.

Roadmap

SSO, LMS integrations (SCORM/xAPI/LTI), and organizational admin controls are under development for enterprise plans. If your security review needs specific commitments, talk to us.