// Trust & Security Report
LearnWorlds
AI-powered Learning Management System (LMS)
Certifications held
2
Maturity
Growth
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on learnworlds.com“LearnWorlds is ISO 27001-certified and provides data encryption and automated vulnerability scanning.”
Verify on learnworlds.com“LearnWorlds is registered with Information Commissioner's Office with Reference Number: ZA372094.”
> Show 4 unconfirmed / not-held certifications
source: learnworlds.comGoogle Cloud Platform is a leading cloud provider, and holds industry best security certifications, such as SOC2/3 and ISO27001 — this refers to GCP's certs, not LearnWorlds' own.
source: learnworlds.comNo HIPAA certification or BAA mentioned on any LearnWorlds policy or security page. Platform is used to deliver HIPAA training content, not to process PHI under HIPAA.
source: learnworlds.comLearnWorlds (a Cyprus/EU-based company) does not itself self-certify under the EU-U.S. Data Privacy Framework. The privacy policy states 'all of our subprocessors are included in the Data Privacy Framework list,' i.e. LearnWorlds relies on its U.S. subprocessors' DPF status, the EU adequacy decision, and Standard Contractual Clauses for transatlantic transfers. DPF self-certification is only available to U.S. organizations, so an EU vendor cannot hold it directly.
source: learnworlds.comLearnWorlds itself does not store, process, or transmit any credit card information. Instead, we rely on trusted payment gateway providers, such as Stripe and PayPal, to manage all credit card data securely. These providers are PCI DSS Level 1 Service Providers.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Google Cloud servers in Europe (Frankfurt, Germany) and USA (South Carolina, Virginia). Additional regions: Sao Paulo (Brazil) and Singapore for APAC customers. DPA restricts EU customer data to the EEA by default; international transfers use Standard Contractual Clauses (SCCs).
Privacy policy explicitly states: 'LearnWorlds does not use data obtained via such integrations to develop, improve, or train generalized artificial intelligence (AI) or machine learning (ML) models.' The Terms grant a broad content license for platform improvement and diagnostic purposes, but the privacy policy carves out AI/ML model training. No evidence of training on customer course content or learner data.
// Security controls
Cloud Infrastructure
Google Cloud Platform (GCP) — primary provider. GCP holds SOC2/3 and ISO27001 certifications. LearnWorlds does not self-host.
learnworlds.comEncryption in transit
HTTPS enforced everywhere; minimum TLS 1.3 across all platform subdomains and sites. Free lifetime SSL certificate for all schools.
learnworlds.comEncryption at rest
Provided by GCP infrastructure. All user passwords salted and hashed; never stored or transmitted as plaintext.
learnworlds.comData isolation
Each LearnWorlds school has its own isolated database; a compromise of one school does not affect others.
learnworlds.comBackups
Daily database backups mirrored and stored off-site across multiple facilities. The High Volume & Corporate plan adds multiple daily backups.
learnworlds.comMFA / 2FA
2FA available on all plans (OTP via email or authenticator app). Admin-configurable as optional or mandatory per user role.
learnworlds.comPenetration testing
Internal testing mentioned: 'We test our systems regularly through simulated attacks from the outside and in.' No third-party pentest reports published.
learnworlds.comVulnerability scanning
Automated systems monitor infrastructure for new vulnerabilities and versions. In-house security expert reviews on an ongoing basis.
learnworlds.comBug bounty / responsible disclosure
No HackerOne or Bugcrowd program found. Security issues should be reported to support@learnworlds.com. No public bug bounty reward program.
learnworlds.comSSO
Multiple SSO supported. Learning Center plan: 3 SSO; High Volume & Corporate: 8 SSO.
learnworlds.comUptime SLA
99.95% server uptime guarantee. Optional custom SLA for High Volume & Corporate plan.
learnworlds.comSubprocessors
Published in DPA. Key subprocessors: Google Cloud EMEA (hosting), MongoDB (database), Mailgun (email), Freshworks (support), HubSpot (CRM), Cloudflare (CDN/DDoS), Wistia/Vimeo (video), Zoom (conferencing), Mixpanel (analytics), Sentry (error tracking).
learnworlds.comSDLC security
Code reviewed against latest patterns. XSS vulnerability avoidance enforced. Key management: secrets kept out of version control. Access controls on need-to-know basis for employees.
learnworlds.com// Products & data scope
data: Course content, learner profiles, payment data (via Stripe/PayPal). 1 admin. Basic integrations. DPA applies via ToS.
Entry-level tier at $29/month. Per-enrollment fee ($5). SSL, Google Analytics user tracking. AI tools included.
data: Same as Starter plus SCORMs, live sessions, subscriptions. 5 admins. Expanded integrations via Zapier and 50+ native connectors.
$99/month. No transaction fees. AI Translations included. DPA applies via ToS.
data: Full learner data, AI insights, advanced reports, API/Webhooks, LTI 1.3. 25 admins. 3 SSO. HubSpot CRM integration.
$299/month. Most popular plan. Includes interactive AI video, AI subtitles, automations. DPA applies.
data: Full data scope including custom reporting, multiple schools. 8 SSO. Premium cloud servers, multiple daily backups, optional custom SLA, optional DPA negotiation.
Custom pricing. Dedicated Success Manager, priority phone support. DPA available by default or negotiated separately. This is the tier most relevant for enterprise procurement review.
// What to watch
- ISO 27001 certification claim is made on a marketing/blog page ('LearnWorlds is ISO 27001-certified', verified present at the choose-customer-education-platform URL) but no public certificate, audit report, or accredited body reference is provided. Notably, the dedicated Data Security page does NOT claim ISO 27001 for LearnWorlds itself; it only attributes ISO27001 to its cloud provider (Google Cloud). Treat as self-attested and request the certificate before relying on it.
- EU-U.S. Data Privacy Framework is NOT a certification LearnWorlds holds. As a Cyprus/EU-based company it cannot self-certify under the DPF (a U.S.-only program). The privacy policy confirms it relies on its U.S. subprocessors being on the DPF list, plus the EU adequacy decision and SCCs, for transatlantic transfers. This entry was previously mislabeled as held=true and has been corrected to held=false.
- Broad content license in ToS grants LearnWorlds rights to 'prepare derivative works from' customer content for platform improvement; privacy policy separately carves out AI/ML model training. These should be read together and evaluated carefully for sensitive content use cases.
- No SOC 2 Type 2 certification for LearnWorlds itself. The data security page references SOC2 only in the context of their cloud provider (GCP). Enterprise buyers needing SOC 2 should request documentation or consider this a gap.
- No formal bug bounty platform (HackerOne/Bugcrowd). Responsible disclosure via email only (support@learnworlds.com).
- HIPAA: Platform delivers HIPAA training content but does not claim to be HIPAA-compliant for PHI processing. No BAA offered.
- DPA became publicly available and included in all ToS from June 1, 2024. Prior customers may need to request the DPA explicitly.
// At a glance
Pricing model
SaaS subscription. Monthly or annual (up to 20% discount). Tiers: Starter ($29/mo + $5/enrollment), Pro Trainer ($99/mo), Learning Center ($299/mo), Enterprise (custom). No transaction fees from Pro Trainer up.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on LearnWorlds's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
learnworlds.com