Security and privacy

We never ask for your other passwords

• We never ask for your Board, CE Broker, DEA or any other outside password, and we never sign in anywhere as you.
• You bring records in yourself: upload a certificate or a transcript, or forward a certificate email to your own private inbox address.

License and DEA numbers are encrypted and masked

• License, DEA and other registration numbers are encrypted before they are saved (AES-256-GCM), with the key kept outside the database.
• Each encrypted number is tied to your account, so a copied value cannot be read on anyone else's.
• On screen we show only the last four characters. Your renewal packet shows full numbers only when you ask for them, and that choice is logged.

Your files are yours

• Certificates, cards and other files you upload are stored outside the public part of the site under random names. They are sent only to you, after you sign in; anyone else asking for them gets "not found."
• Files are never kept in your browser's offline storage.

No patient information

• We never ask for patient information. Every case in our courses is made up.
• Please don't upload anything that shows patient information. Your certificates and cards are all we need.

Your account

• Your EdPortus password is stored only as a one-way hash (bcrypt), so no one here can read it.
• Repeated sign-in attempts are slowed down, and resetting your password signs out every browser that was signed in.
• The site is served only over encrypted connections, and the sign-in cookie cannot be read by scripts on the page.
• Card payments are handled by Stripe. We never see or store your card number.

Staff access is limited and recorded

• Each staff member has a role that allows only what that job needs: owner, admin, content reviewer or support.
• No staff role can sign in as you or see your account the way you do.
• Staff screens are on a separate address with their own sign-in.
• Every download of learner information from the staff screens, and every change to who has staff access, is written to an audit log with who did it and when. Changes to your licenses, credentials, credits and documents are logged the same way.

Your location

• To open the home page on your state, our own server looks up which state your network address belongs to. It does not save the address or send it to anyone.

Deleting your information

You can remove any license, credential, credit or document from your account at any time, and it disappears from your account right away.

To close your account and have your information deleted, write to us from the email address on your account.

We keep course completion and certificate records for at least six years, because accreditation rules require it.

Write to support@edportus.com.

Reporting a security problem

If you think you have found a security problem, write to us with "Security" in the subject line. Tell us what you found and how to see it.

Please test only with your own account, don't look at or change anyone else's information, and give us reasonable time to fix the problem before telling others.

We answer within five business days.

Write to support@edportus.com.