Preparing your workspace
Security, privacy, and accessibility at every layer.
Drivia is built for organizations that review security, privacy, and accessibility before they buy. This page says what is true today, and names what Drivia does not offer yet.
Tenant isolation
TodayEvery row carries an organization id, and Postgres row-level security enforces that an organization reads only its own data.
Last checked
Accessibility
TodayWCAG 2.1 AA is the target. Our VPAT 2.5 lists the known gaps instead of claiming conformance, and we will walk your reviewer through them.
Last checked
LTI 1.3
TodayDrivia launches inside your LMS as an LTI 1.3 tool, with deep linking and grade return. It is not certified by 1EdTech.
Last checked
FERPA
In buildA data processing agreement for schools and colleges is being written. It is not available yet.
Last checked
GDPR
In buildA data processing agreement is being written. It is not available yet. Learners can already export their data and delete their account.
Last checked
SOC 2
Not offeredDrivia does not have a SOC 2 report. We answer security questionnaires directly.
Last checked
ISO 27001
Not offeredDrivia does not hold ISO 27001 certification.
Last checked
HECVAT
Not offeredDrivia has no completed HECVAT to share.
Last checked
HIPAA
Not offeredDrivia does not offer a Business Associate Agreement and is not for protected health information.
Last checked
Single sign-on
Not offeredSingle sign-on is not offered as a standard feature. Talk to us about your identity provider.
Last checked
Security questionnaires are answered directly. Contact support@drivia.consulting.
Every row carries an organization id, and Postgres row-level security enforces that an organization reads only its own data.
Single sign-on is not offered as a standard feature. Talk to us about your identity provider.
You sign in with a password or an email code, and you can add an authenticator app as a second step. Passkeys are coming. We do not offer text-message (SMS) codes. An email code proves you can read your inbox; it is a first step, never a second step for staff accounts.
Every page is served over HTTPS with HSTS, and a Content Security Policy limits where scripts may load from.
Admin actions and parental-consent events are written to an audit trail.
Uploaded documents and community images are checked against a file-type allow-list, and their bytes must match the type they claim.
Every commit is scanned for secrets by a pre-commit check before it is accepted.
Being an instructor or organization admin does not give anyone access to your JAX conversations. A parent of a child account can read them. A named safety reviewer, who may be an admin given that separate permission, can open one only to respond to a safety or support case or a legal hold. Every opening is logged, lasts 15 minutes, and shows in your JAX history.
WCAG 2.1 AA is the target. Our VPAT 2.5 lists the known gaps instead of claiming conformance, and we will walk your reviewer through them.
VPAT 2.5: ask for it, and we will walk your reviewer through the open items. Contact support@drivia.consulting.
Learners can export their data and delete their account. The Privacy Policy sets out the rights California residents have.
Drivia does not have a SOC 2 report. We answer security questionnaires directly. Our database provider (Supabase) publishes its own security documentation.
Drivia is designed to integrate with your existing technology ecosystem.
LTI 1.3
LTI 1.3 integration with OIDC authentication, deep linking, and grade passback (AGS). Embed Drivia inside Canvas, Blackboard, Moodle, Brightspace, Schoology, and other LMSs that support LTI 1.3. It is not certified by 1EdTech.
Available — Learn More →xAPI (Tin Can)
Experience API support allows learning activity data to flow into your Learning Record Store (LRS) for enterprise analytics and compliance reporting across platforms.
Coming SoonREST API & Webhooks
Full REST API with HMAC-SHA256 signed webhooks for real-time event streaming. Integrate enrollment, completion, and assessment data with your HRIS, CRM, or analytics platform.
AvailableCSV / JSON Data Export
Export any dataset — members, enrollments, progress, quiz results, audit logs — in CSV or JSON. Scheduled exports and API-driven exports available for enterprise clients.
AvailableWe can share our VPAT 2.5, answer your security questionnaire, or set up a live security review call.