Security and privacy

LearnBoard reads your Moodle data to draw its dashboards, and it can never change that data. This page explains how read-only access is enforced, how each workspace is kept apart from every other, how sign-in is protected, and what is recorded and kept. It is for workspace administrators, Moodle administrators and anyone answering a security or privacy review.

At a glance

• Read-only, enforced several times over: the database account, a query check on every statement, a connection that refuses writes, a database session set to read-only, and, with the plugin, Moodle’s own check as well.
• Your learner data stays in Moodle. LearnBoard reads it where it lives and keeps worked-out figures for speed, held separately for each workspace.
• Every workspace is separate, enforced on the server, not by hiding things on screen.
• Everyone signs in as themselves, by invitation or from Moodle, with optional two-factor sign-in.
• An audit log records report, AI and administrative events, kept for 730 days by default.

LearnBoard only ever reads

Nothing in LearnBoard writes to your Moodle site. Not a screen, not a CSV, not the AI assistant, not a background update. For a write to reach your Moodle data, every one of these separate safeguards would have to fail at once.

1. The database account

The account LearnBoard reads with needs SELECT and nothing else. If you give it more, the layers below still refuse a write.

2. The query check

Every statement is checked before it runs. Only SELECT, WITH, SHOW, DESCRIBE and EXPLAIN pass. Write verbs, functions with side effects, file reads and several statements in one go are rejected. Anything unclear is rejected too.

3. The read-only connection

The connection LearnBoard opens to your database is read-only every time. There is no mode in which it is not, and nothing in the product can ask for one.

4. A read-only database session

Every database session, reconnections included, is set to read-only on the database server itself, so the database refuses a write even if one got past the layers above.

When you connect through the Moodle plugin

The plugin adds its own checks on your Moodle server, on Moodle’s terms rather than LearnBoard’s:

• Reads only: no write, no change to the database structure, no lock, no delay and no file access.
• This site’s tables only: no other database on the server.
• No secrets: tables that hold site secrets (configuration, sessions, web service tokens, private keys) are refused, and password, token and key columns are dropped from results even when a query asks for every column.
• One statement per request, with bound values.
• Signed requests over https only. Each request is signed with your connector key, can be used once, and must arrive on time.
• Your database stays closed. LearnBoard asks through your Moodle site’s own https address, so the database never accepts a connection from outside the server.
• An optional read-only database user. Set Read-only database user in the plugin settings, and LearnBoard’s queries run on an account granted SELECT only, so a write is impossible at the database level too.
• An optional address list. LearnBoard server addresses limits which addresses may ask at all.
• A record on your side. The plugin writes every request to an audit file in the Moodle data directory, so the Moodle administrator can see what was asked and when.

If the plugin cannot set a read-only session, it refuses to run any query at all. See Moodle requirements and the Moodle plugin section.

When you connect to the database directly

Create a database account for LearnBoard that is granted SELECT only on your Moodle database. LearnBoard only ever reads, so SELECT is enough. The query check, the read-only connection and the read-only session apply to every statement.

When you upload a copy

An uploaded copy is loaded into a private space of its own for your workspace. Your live Moodle site is not touched at all.

Note

LearnBoard also refuses to treat its own database as a data source, and a Moodle plugin address must be the public https address people use to open your site.

Where your data lives

• Learner data stays in Moodle. LearnBoard does not migrate your Moodle site or become a second system of record. It reads your data where it already lives.
• Worked-out figures are saved for speed. LearnBoard keeps the figures it has worked out, so screens open quickly without asking Moodle again. These saved figures are held for each workspace and each data source separately. Switching data sources never shows figures from the previous one. See how figures are worked out.
• What LearnBoard stores about your workspace: the people you invite and their roles, the dashboards you build, your branding and settings, AI conversations, and the audit log.
• Secrets stay on the server. Database passwords, connector keys and AI provider keys never reach a browser, including inside Moodle.

Each workspace is separate

One LearnBoard service holds many organisations, each in its own workspace with its own people, data sources and figures. The separation is enforced on the server, on every request:

• Every screen, CSV, saved figure and AI answer is tied to one workspace.
• A person can only read the workspace they belong to.
• The AI assistant never sees another workspace’s data.
• An audit log reader sees their own workspace’s events only.

Who can see what

Access is role based, with permissions held for each screen and each action. A Viewer cannot reach a Manager’s screen by typing its address, because the server checks the permission on every request.

• Team leads read through their own Moodle groups on every screen.
• Learners are bound to their own records on the server. Workspace-wide screens stay closed to them.

See roles and permissions.

Signing in

One person, one account

People are invited by email and choose their own password. There are no shared logins. An address that has not been confirmed cannot sign in: LearnBoard sends a six-digit code to confirm it.

Strong passwords

At least 12 characters, with upper and lower case, a number and a symbol. Passwords are stored with Argon2id, a modern memory-hard hash.

Checked at the door

Every sign-in passes a check that you are human, and repeated failed attempts are slowed down.

Sign in with Moodle

With the plugin’s per-user sign-in on, people open LearnBoard from Moodle with no second password. The single-use ticket works once, for a minute or two.

• Changing your password signs you out everywhere else as soon as it is set.
• A password reset link works once and expires within the hour. The reset screen answers the same way whether or not an address has an account, so nobody can use it to test one.
• Deactivating a person ends their session at once and stops them signing in.

Two-factor sign-in

Two-factor sign-in asks for a six-digit code from an authenticator app as well as your password. It works with Google Authenticator, Microsoft Authenticator and any app that reads a QR code.

1. Open the account menu in the top bar and choose Profile & account.
2. Under Two-factor sign-in, choose Set up two-factor sign-in.
3. Scan the QR code with your authenticator app, then type the six-digit code it shows.
4. Save the recovery codes somewhere safe. They are shown only once. Each one lets you sign in once without your app.

With two-factor sign-in on, a correct password alone never opens a session. Turning two-factor sign-in off asks for your password again, so an open browser tab is not enough to remove it.

The audit log

The audit log records who did what in your workspace: report events, AI questions and administrative actions, each with the account and the time.

• Who can read it: workspace Admins, on plans that include the audit log. Admins see their own workspace only.
• Filters: event type, person, date and free-text search. Select a row to see the full event.
• Reading is recorded too. Opening the audit log writes its own event.
• Hostile prompts are visible. An attempt to get the AI assistant to read something it should not is written as its own event, so it is seen rather than silent.
• Export: Admins can download the log as CSV.
• Retention: entries are kept for 730 days by default.

Data retention and deletion

What	How long
Audit log entries	730 days by default
Your Moodle data	not copied by LearnBoard when it reads your site or database; it stays in Moodle
Saved figures	replaced as they are worked out again, as set under data freshness
A workspace you delete	locked at once, and removed after 7 days unless an Admin restores it

A workspace Admin can delete the workspace from Your subscription with Delete this workspace. The workspace is locked straight away, and any Admin of the workspace can restore it within 7 days. After that, its people, data and settings are removed. A card subscription is cancelled at the moment you ask.

Tip

Each person can remove their own AI conversations in the assistant with Delete conversation.

Errors never show internals

When something fails, LearnBoard shows a plain message and a short reference number. It never shows SQL, stack traces or server details. The reference number lets support find the full detail in the server log.

Related

The AI assistant and your dataWhat the assistant reads and why it cannot change anything.

Roles and permissionsEvery role, screen and action.

Moodle requirementsVersions, databases and plugin settings.

LearnBoard security pageThe public security summary on the LearnBoard website.