Data Security
Last modified: October 13, 2026
This overview covers the Konstantly Service operated by KONSTANTLY, LLC. Read it alongside our Privacy Policy, Terms of Serviceand any applicable signed security commitments or data processing agreement ("DPA").
Access and credentials
The Service uses account authentication, role-based permissions and workspace boundaries to control application access. Customers choose administrators, user permissions and integrations and must protect their credentials. Revoke access and API keys that are no longer needed and contact support promptly about suspected unauthorized use. External integrations can access or change data within the permissions granted to them.
File access is separate from workspace access
Some course media and uploaded files are served through direct URLs that can be opened without signing in. A private workspace or restricted course does not make every underlying file URL private. Do not use those uploads for information requiring authenticated file access. Contact support to establish whether a feature meets your requirements before uploading confidential or regulated materials. A hard-to-guess URL is not an access-control guarantee.
Hosting and transport
Infrastructure and delivery use providers including AWS, DigitalOcean and Cloudflare, depending on the service and deployment. Public production web connections use HTTPS. This overview does not promise a particular encryption algorithm for every record, an exclusively regional processing boundary, or end-to-end encryption. Request current workspace-specific information if you have a security or residency requirement.
Where data is stored
The data of our European clients is stored at Amazon Web Services (Frankfurt, Germany), with uploaded files at DigitalOcean (Frankfurt, Germany) and additional backup and redundancy at Hetzner and AWS (Dublin, Ireland), and processed primarily at Amazon Web Services (Frankfurt, Germany). The contact information of our client companies and their contact persons is kept in the customer-relationship tools listed in our Privacy Policy, whose storage locations vary by provider.
We store the data of our clients from the US and other regions at Amazon Web Services (Frankfurt, Germany; N. Virginia; N. California), with uploaded files at DigitalOcean (Frankfurt, Germany).
Regardless of where your information is stored or processed, we apply the same protections described on this page.
Operations and recovery
Access controls, logging, monitoring, maintenance and recovery procedures help us operate and protect the Service. Their scope varies by component. Customers should retain source materials and use available exports for records they need to preserve. Unless a signed agreement expressly provides otherwise, we do not promise continuous backups, a particular restore point, automatic failover, uninterrupted service or a fixed response or resolution time.
Data processing and incidents
Where applicable law requires a DPA, contact [email protected] to arrange one before that processing begins. Creating an account does not execute a DPA or international transfer clauses. Customer instructions, relevant providers, locations and safeguards must be addressed in the applicable arrangement. This page is not a certification of compliance with a particular law or standard.
We will investigate security reports and provide incident notifications and assistance as required by applicable law and an applicable DPA. A notification may be updated as facts become available and does not, by itself, admit fault. Do not send passwords, API secrets or unnecessary personal data in a report.
Report an issue
Send security concerns and support requests to [email protected]with a description, affected feature and safe steps to reproduce. Do not access other customers' information, disrupt the Service or publicly disclose private data to demonstrate an issue. No system can eliminate every security risk.