Your data is protected. Your trust is earned.
Coursebox is built on enterprise-grade security. From how we handle your AI data to where we host your platform, every decision is made with your privacy in mind.
GDPR certified (Certificate #17412, AQSR) · Azure OpenAI · ISO 27001-certified Google Cloud EU hosting · TLS encryption in transit and at rest
Security built into every layer
We don't bolt security on as an afterthought. It's engineered into how Coursebox works.
Coursebox Pty Ltd is formally assessed and certified for GDPR compliance by AQSR (accredited by USAC) under Certificate #17412, current from July 2026 following successful completion of our annual surveillance audit. All personal data is handled lawfully, fairly, and transparently.
Your course content, learner data, and proprietary materials are never used to train public AI models — not by Coursebox, and not by any of our AI providers. This is contractually assured.
Every Coursebox portal is hosted on Google Cloud Platform in the EU (France region) — infrastructure certified to ISO 27001, ISO 27017, ISO 27018 and SOC 2, with redundant architecture, daily backups (14-day retention), and full GDPR compliance.
Powered by Azure OpenAI — not the public API
In June 2024, Coursebox moved all AI features to Microsoft's Azure OpenAI Service — a private, enterprise-grade environment. Unlike the public OpenAI API, Azure OpenAI means:
Your data is not used to retrain any models
Built-in protections against data leakage and unauthorised access
GDPR-aligned data storage and handling
Backed by Microsoft's global datacentres with high uptime and resilience
Options for organisations to set boundaries around AI usage
Responsible AI, by design
We think carefully about how AI is used in Coursebox — and we are transparent about it.
All AI-generated course content is reviewed and edited by course admins before any learner sees it. You stay in control of what gets published — AI is your assistant, not the decision maker.
Coursebox's policy: customer content and learner data are never used to train or fine-tune AI models unless explicitly agreed in writing. All AI providers we use are held to the same standard.
Since 2 August 2026, Coursebox has enabled AI disclosure notes for interactive AI features (AI Tutor, grading), machine-readable markers for AI-generated content, and contextualised notes for AI-generated video.
Our AI providers and their data commitments
Every AI provider Coursebox uses is evaluated for security posture, data handling, and enterprise compliance before integration.
Microsoft Azure OpenAI — AI writing, tutoring, and content generation. Does not use customer data to retrain models.
Google Gemini Pro — AI image generation. Image prompts and responses are not used to train Google's models.
Microsoft Azure Neural TTS — AI voiceovers. Data is not used to retrain public models.
HeyGen — AI avatar video. Formally confirmed opted out of model training (26 Feb 2026).
Plain AI with Anthropic Claude — Support chatbot for administrators. Under Plain AI and Anthropic's enterprise terms, customer data is not used to train public foundation models.
Mistral — Document image extraction. Extracted content stays within your Coursebox environment.
Hosting built for compliance
Every Coursebox portal runs on infrastructure designed to meet the highest standards of security and data protection.
European cloud hosting in the EU (France region), on infrastructure certified to ISO 27001, ISO 27017, ISO 27018 and SOC 2. Meets GDPR and EU data protection requirements. Redundant infrastructure with daily backups retained for 14 days.
Business and Enterprise clients can select Google Cloud regions outside France, to align with existing enterprise infrastructure or specific data-residency requirements.
Where personal data is transferred outside the EU/EEA, Coursebox ensures adequate protections through Standard Contractual Clauses (SCCs) and GDPR-compliant cloud providers.
Coursebox uses a defined set of sub-processors under GDPR Article 28: Microsoft (Azure OpenAI, Neural TTS), Google LLC (Google Cloud, Gemini), OpenAI L.L.C., HeyGen Inc., Mistral, Amazon Web Services, and Plain AI with Anthropic. Where personal data is processed outside the EU/EEA, transfers are covered by EU Standard Contractual Clauses (Module Two).
The Google Cloud infrastructure Coursebox runs on is certified to ISO 27001. Coursebox Pty Ltd has also begun its own company-level ISO 27001 certification project, with implementation kicking off in September 2026. We will update this page once certification is achieved.
Security questions, answered
No. Coursebox's policy is that customer content and learner data are never used to train or fine-tune AI models unless explicitly agreed in writing. This applies to Coursebox and all our AI providers.
By default, all Coursebox portals are hosted on Google Cloud Platform in the EU (France region) — infrastructure certified to ISO 27001, ISO 27017, ISO 27018 and SOC 2, meeting GDPR requirements. Business and Enterprise clients can select alternative Google Cloud regions.
Yes. Coursebox Pty Ltd is formally certified for GDPR compliance by AQSR. Certificate Number: 17412, current from July 2026 following our annual surveillance audit. Verify at www.aqsrworld.com.
All data transmitted between users and Coursebox is encrypted using TLS. Data stored on Coursebox infrastructure is encrypted at rest.
We transitioned in June 2024 to give clients greater assurance over data privacy. Azure OpenAI runs within Microsoft's private enterprise cloud — your data never passes through shared public infrastructure.
HeyGen has formally confirmed in writing (26 February 2026) that Coursebox's Enterprise API account is fully opted out of model training and removed from all data training pipelines.
Since 2 August 2026, Coursebox complies with EU AI Act Article 50 — AI notes for interactive features, machine-readable markers for AI-generated content, and disclosures for AI-generated video. Where courses are exported via SCORM or LTI into a third-party system, responsibility for providing any required AI transparency rests with the course publisher.
Yes. Visit www.aqsrworld.com and search using Certificate Number 17412 to independently verify Coursebox's GDPR compliance certification.
Have security questions?
Contact our team at support@coursebox.ai or read our full Privacy and Data Protection documentation.
Read our complete Privacy and Security policy — including platform architecture, GDPR compliance, responsible AI practices, and third-party provider data commitments.
Our GDPR certification is subject to annual assessment by AQSR to ensure ongoing compliance as regulations and AI capabilities evolve.
Need a security questionnaire, Data Processing Agreement, or procurement documentation? Contact your Coursebox Account Manager or reach out at support@coursebox.ai.