Encryption
Traffic between browsers and MyPass is encrypted with TLS 1.2 or higher. Stored data is encrypted at rest. That covers learner records, course files, assessment results and reports.
SECURITY AND HOSTING
Security your reviewer can check line by line
MyPass LMS runs on Amazon Web Services. This page sets out what AWS is responsible for, what Kprise is responsible for and what stays in your hands, in enough detail for your IT or security team to sign off.
Start free trial
Explore it yourself.
15 days, no credit card.
Book a demo
A 30-minute walkthrough
of your use case, with our team.
Building learning software since 2010 · 130 organizations in 11 countries · Encrypted in transit and at rest
Your organization
You control- Who is an admin
- Roles and groups
- Your SSO and MFA rules
- Audit log retention
- AI on or off
MyPass LMS
Kprise runs- Application security
- TLS 1.2+ and encryption at rest
- Role-based access
- Audit trail
- Backups
- Security updates
- Monitoring
Amazon Web Services
AWS runs- Data centres
- Hardware and network
- FedRAMP Moderate and High
- SOC 2 Type II
- ISO 27001
Each layer is run by one party, and each party answers for its own layer.
Who is responsible for what
Most security questions are really this one. A cloud application has three owners, and a reviewer needs to know which one answers for each control.
AWS
The physical and network layer
Amazon runs the data centres, servers, storage and network that MyPass is hosted on, and has them independently audited.
FedRAMP ModerateFedRAMP HighSOC 2 Type IIISO 27001
These attestations belong to AWS and cover AWS infrastructure. AWS publishes the reports through AWS Artifact.
Kprise
The MyPass application
We build MyPass and run it for you on the hosted plans.
- Encryption in transit (TLS 1.2+) and at rest
- Role-based access and per-organization SSO
- Audit trail of learner and admin activity
- Backups, security updates and new versions
- Monitoring of the hosted platform
You
Your people and your rules
Your administrators decide who gets in and what they can do.
- Who has admin rights, and which role everyone else has
- Password and multi-factor rules, through your identity provider
- How long audit logs are kept
- Whether AI features are switched on
Straight answer
MyPass itself is not FedRAMP authorized, SOC 2 audited or ISO 27001 certified. AWS holds those for the infrastructure underneath, and our application controls follow the same frameworks. If you are comparing vendors, ask each one which certificates are their own and which belong to their host. If your policy requires data to stay in an environment you control, the Free Edition runs on your own server.
Controls built into the product
These are on by default or set by your administrators. None of them is an add-on.
Single sign-on
SAML 2.0 and OAuth 2.0, so staff sign in through Okta, Microsoft Entra ID, Google Workspace or another provider that supports them, and your password and MFA rules apply. Association members can sign in with their AMS account. Each organization has its own SSO settings.
Roles and permissions
Administrators, instructors, group managers and learners each see and change only what their role allows. A chapter manager sees their chapter, not the whole membership.
Audit trail
Logins, enrollments, course activity, quiz attempts and certificates are recorded with a timestamp and the person who did it. Old versions of edited records stay in the trail. You set how long the audit log is kept.
Exam integrity
Webcam proctoring records exam attempts and flags possible violations for a person to review, so a certificate rests on an attempt you can check.
Content protection
With MyPass DRM, protected documents open in a secure reader that blocks download, copy and print, can be limited to approved devices, and are encrypted with keys that are rotated.
Setting up SSO or an AMS login? The integrations page covers the identity providers and AMS platforms MyPass connects to.
Your data stays yours
The same terms apply on every hosted plan, and they are in our Terms and Privacy Policy.
What we will and won't do with it
- You own everything you upload or create. We host and process it only to run the service.
- Your organization is the data controller for learner data. Kprise is the processor.
- We never sell personal data.
- Your data is not used to train shared AI models. AI features run inside your workspace and can be switched off for all of it.
- Learners keep their GDPR and CCPA rights. Their requests come to your organization first, as the controller.
From sign-up to leaving
- While you use itData is kept for as long as your subscription runs, encrypted and backed up.
- Audit logsKept for the period you set, to match your own retention policy.
- UptimeWe aim for 99.9% on paid plans. Service level terms are in your agreement, and planned maintenance is announced in advance.
- If you leaveYou have 30 days to export everything. After that, your data is deleted.
Choose where it runs
Every plan has every feature. What changes is how much of the hosting is yours alone, and who runs it.
Starter
Shared servers
Runs on AWS servers shared with other MyPass customers, at a MyPass web address. We handle backups, security updates and new versions.
Smaller teams and first programs
Professional
A server of your own
Your organization gets its own server and its own web address, such as learn.yourorg.org. We run it, back it up, patch it and watch it more closely.
Associations and certification programs
Enterprise
Several servers
MyPass runs across more than one server, so it stays up if one fails. Comes with a dedicated contact and a service agreement written for you.
Large or regulated organizations
Free Edition
Your own server
Install MyPass on a server you control, inside your own network or cloud account. Data never leaves your environment, and your team runs the backups and updates.
Teams whose policy says data stays in-house
Prices and learner limits are on the pricing page.
Going through a security review?
Bring your questionnaire and your reviewer. You will talk to people who build and run MyPass, not a sales script.
- Send your questionnaireAny format your team uses. We fill it in and send it back.
- Walk through the architectureA call with your reviewer covering hosting, encryption, access, the audit trail and backups.
- Agree the termsData processing and service level terms set in your agreement. Enterprise gets a service agreement written for you.
Security questions, answered
Is MyPass LMS FedRAMP authorized or SOC 2 certified?
No. MyPass runs on Amazon Web Services, and AWS holds FedRAMP authorization at the Moderate and High baselines, SOC 2 Type II and ISO 27001 for that infrastructure. MyPass itself has not been through its own FedRAMP authorization, SOC 2 audit or ISO 27001 certification. Our application controls follow those frameworks, and we will walk your reviewer through them. If your policy requires data to stay in an environment you control, the Free Edition installs on your own server.
Who owns the data we put into MyPass?
You do. Kprise hosts and processes it only to provide the service. For learners, your organization is the data controller and Kprise is the processor. We do not sell personal data.
Is our data used to train AI models?
No. AI features such as course generation, grading help and translation run inside your organization's workspace, and your data is not used to train shared AI models. An administrator can switch AI features off for the whole workspace.
What happens to our data if we leave?
Your data stays available for export for 30 days after the subscription ends. After that it is deleted.
What uptime do you commit to?
We aim for 99.9% uptime on paid plans, and the service level terms are written into your subscription agreement. Scheduled maintenance is announced in advance. Enterprise runs on several servers, so the platform stays up if one fails.
Can we use our own single sign-on?
Yes. MyPass supports SAML 2.0 and OAuth 2.0, so it works with Okta, Microsoft Entra ID (formerly Azure AD), Google Workspace and other identity providers that support those standards. Your provider's password and multi-factor rules then apply to MyPass sign-ins.
Will you fill in our security questionnaire?
Yes. Send it in whatever format your team uses, and we will answer it and join a call with your reviewer to go through the architecture and controls.
See it before your reviewer does
Book a 30-minute demo to see the admin roles, SSO and audit trail on a live MyPass site, or start a free trial and look around yourself.
Hosted on AWS
Start your free hosted trial
Explore it yourself.
15 days, no credit card.
Book a demo
A 30-minute walkthrough
of your use case, with our team.