Security and data protection
Where your data is stored
Origin’s database is hosted in the EU, in Paris, France. Learner accounts, progress and results are stored there.
Some supporting services come from companies based outside the EU: for example the AI models behind Origin AI, video streaming, email delivery and payments. The data processing agreement lists each of them, where it is based and the legal safeguard that applies.
Who can see what
Every school’s data is kept apart from every other school’s by row-level security in the database: each request is checked against the account that makes it.
Inside a school, admins, teachers and learners each see only what their role allows. Every report run is logged: who ran it, when, and who it was emailed to.
Signing in
Learners and staff can sign in with the school account they already have, through single sign-on (SAML 2.0). Two-factor sign-in is available.
Encryption and payments
Data is encrypted in transit and at rest. originlms.com is served over HTTPS only.
Card payments are handled by Stripe, which is certified to PCI DSS. Card details never reach Origin’s servers.
Origin AI and your material
Courses and lessons you build with Origin AI from your material wait for a teacher’s approval before learners see them. Munin’s short review questions are written by AI from your approved lessons and checked automatically.
Which AI models Origin uses, what they see and what a person checks is set out on the AI page.
GDPR and the data processing agreement
Your school decides which learner data goes into Origin and why. Under GDPR that makes your school the controller and Origin the processor.
We sign a data processing agreement (personuppgiftsbiträdesavtal) with every customer. Ask for it and we send it, together with the list of sub-processors. We help you answer learners who ask to see, correct or delete their data.
Exports, and when you leave
Reports export as PDF, XLSX or CSV, and the API and webhooks let your own systems read your data.
Certificates belong to the learner. They stay valid if your subscription ends.
Certifications
Origin is built to the OWASP Top 10. Work toward ISO 27001 and SOC 2 has started. Neither certificate is held today; when one is, it will be listed here with its date.
Report a security issue
If you think you have found a security problem in Origin, call +46 76 426 26 60 (Monday to Friday, 09:00–18:00 CET) or write to us through the help center. Please do not test against other customers’ data.