Layered safeguards for accounts, courses, and operations
This summary explains how Doveline protects the hosted private beta. It is not a certification, audit report, or guarantee that every security event can be prevented.
Last updated August 1, 2026
Identity and authentication
- Passwords are stored as one-way hashes, never plaintext.
- Email verification protects account activation and sensitive account requests.
- Administrators use multi-factor authentication, with passkey support and step-up verification for sensitive actions.
Authorization and isolation
- Course access and role permissions are checked by the server, not only hidden in the interface.
- Assistant conversations and course context are kept separate by course and user access.
Application safeguards
- Security checks protect actions that change account or course data.
- Input and usage limits help reduce misuse and automated abuse.
- Uploaded and generated content is validated before use.
Monitoring and accountability
- Important security and administrative actions are recorded in access-restricted audit logs for up to 90 days.
- Routine viewing activity and message or conversation content are not copied into the audit log.
- Technical diagnostic logs are retained for up to 30 days.
Hosting and recovery
Doveline primarily stores application data on Microsoft Azure infrastructure in the United States. The service uses HTTPS, encryption, private media storage, restricted administrative access, and protected secret storage. Limited recovery copies are retained temporarily so the service can recover from accidental loss. See the Data deletion page for retention periods.
Provider and AI security
Doveline sends providers only the information needed for the requested feature. AI requests are limited to course material the user is authorized to access and are subject to feature and usage controls. Doveline does not opt in to general-purpose model training with customer or Student Data. Provider details are listed on the Subprocessors page.
Report a security concern
Send suspected vulnerabilities, unauthorized access, or security incidents to support@dovelinelearning.com with “Security report” in the subject. Do not access other users' data, disrupt the service, or include secrets or sensitive personal information beyond what is necessary to explain the concern.