Data Handling Overview
A plain-language overview of how MapleLMS handles customer and learner data.
Public document · Version 1.0 · Last updated 2026-10-29 · Owner: security@maplelms.com
About this document
This is public information. Detailed data-flow diagrams and the authorization boundary are restricted certification data, available to approved federal agencies.
What data MapleLMS processes
- Learner records: name, work email, course enrollments, progress, scores and certificates.
- Authoring content: courses, tests and quizzes created by customer administrators.
- Operational metadata: logins, access logs and audit events.
MapleLMS does not require SSNs or other high-sensitivity PII to operate.
How it is protected
In transit
All connections use TLS 1.2 or higher. Public pages are served over HTTPS through CloudFront.
At rest
Data stores are encrypted with AWS KMS-managed keys, with documented key rotation.
Access
Least-privilege IAM, deny-by-default network rules, and phishing-resistant MFA for administrators (rollout in progress toward full KSI coverage).
Where data lives
MapleLMS is hosted on AWS in dedicated accounts that form the authorization boundary, and learner data resides within that boundary. This Trust Center runs in its own account inside the same boundary and holds only certification data, never learner data.
Retention and deletion
Customer data is retained for the life of the subscription and deleted on contract termination, per the data processing agreement. Audit logs are retained for a minimum of six months and are immutable.