Our ISO 27001 approach
LearnersBench is an ISO 27001-informed system. The standard shapes how we design, build and run the platform, and this page explains exactly what that means – and what it does not.
Last updated 23 October 2026
What ISO 27001 is
ISO/IEC 27001 is the international standard for information security management. Rather than a checklist of products to buy, it sets out how an organisation should identify its information risks, choose controls to treat them, and keep reviewing whether those controls still work. Its companion standard, ISO/IEC 27002, describes the reference controls that organisations select from.
The standard covers the whole of information security: people, processes and technology, across the confidentiality, integrity and availability of information.
Our status, stated plainly
LearnersBench is ISO 27001-informed and self-assessed.
What we do is use the standard as our design framework. When we decide how a feature should handle data, who should be able to see it and what should be recorded, we work from ISO 27001's risk-based approach and its reference controls. We then check our own implementation against those controls and record the gaps honestly.
Where independent assessment does exist, we say so: our Cyber Essentials Plus certification involved technical testing by an accredited assessor, and the certificate is publicly verifiable.
How the standard shapes the system
The controls below are implemented in the product today, each informed by the corresponding area of the standard:
- Access control. Two-step sign-in is required for every staff account, roles limit what each person can do, and every organisation's data is walled off from every other organisation at the database level.
- Cryptography. All traffic is encrypted in transit, and sensitive learner details – such as dates of birth, identity documents and application answers – are encrypted at rest with authenticated encryption before they reach the database.
- Logging and monitoring. Changes to learner records are written to a tamper-evident history, access to sensitive records is logged without the data itself, and errors raise alerts to the team within minutes.
- Data minimisation. Learner lists load only the fields each screen needs, tutors see registers rather than learner records, and learners can only ever see their own information.
- Supplier relationships. We use a small number of vetted suppliers – our database hosted in Ireland, and Resend, Twilio and PeopleCheck for email, text messages and identity checks – and each receives only the data it needs to do its job.
- Availability and resilience. The database is backed up, the application is served from a global edge network, and the system keeps working read-only when a connection drops.
- Secure development. Every change is reviewed, the codebase is covered by an automated test suite, and we run recurring security scans and audits of the whole system.
Ask us anything
If your organisation's security review needs more detail – architecture, data flows, retention or our sub-processor list – email team@learnersbench.com and we will answer directly. Our data protection page covers UK GDPR, and our privacy notice explains how personal data is handled.