TRUST

Security and privacy

Peridot holds your learners’ names, numbers and results, so it’s built to keep each organisation’s data to itself and to keep sign-in simple and hard to abuse. This page says what Peridot does to protect it and what you control.

Your data stays yours

Every request is tied to one organisation, taken from the person’s session or the API key, never from anything in the request itself. One organisation can’t see another’s people, courses or results, and a unit admin sees only their own units.

Who can see what. Each organisation is walled off; inside it, roles narrow what each person sees.

Signing in

No passwords to leak. Sign-in links work once and expire after 15 minutes.
Invites are valid for 7 days.
Sign-in is rate limited, so links and join codes can’t be guessed by trying many times.
Your session lives in a secure, HTTP-only browser cookie that page scripts can’t read.

Keys and secrets

Sign-in links, sessions, invites, launch links and API keys are stored only as fingerprints, so even Peridot can’t read them back. That’s why an API key or webhook secret is shown once. Webhook deliveries are signed so your server can check they came from Peridot. See API keys and Webhooks.

The AI tutor

Learners never hold an AI account or key. A hint request only works for the learner doing that lab, it is limited by your organisation’s settings, and you can turn the AI tutor off. See AI tutor.

What you can see and take with you

The Audit log records every change, including any made by Peridot staff while helping you. Download export in Settings gives you all your workspace’s data as a JSON file at any time.