Security, privacy & operations
Understand product boundaries and the deployment responsibilities behind them.
Application boundaries
ZubLMS uses a Go backend, server-checked roles and company scope, database row-level protections and secure browser sessions. Company SSO secrets and protected profile values use encrypted storage with OpenBao-backed keys. An unavailable key service refuses protected operations rather than returning plaintext.
Authentication, authorisation and data recovery are separate responsibilities. A successful login is not permission to access another company or download a report outside your current scope.
Operational readiness is installation-specific
TLS, trusted host configuration, identity settings, monitoring, email, retention and recovery procedures must be reviewed for the installation. Documentation does not certify compliance with a regulatory framework or promise an availability SLA.
Automatic OpenBao unsealing and off-server backups remain deferred requirements in the current delivery plan. A server restart may require operator unsealing. A running local site is not evidence of tested disaster recovery.
Privacy and support
- Agree data retention, deletion, export and incident responsibilities with your operator.
- Only share the minimum diagnostic information needed for support.
- Never include tokens, passwords, private keys, raw SAML assertions or a full session URL in a ticket.
- Treat downloaded reports as personal information under your company policy.