Security and privacy

Hosting platform and oversight

RFM’s verified staging application services run on Laravel Cloud. Laravel Cloud has achieved SOC 2 Type II attestation for Security, Confidentiality, and Availability, and maintains a public Trust Center for security review materials.

That attestation applies to the hosting platform. It does not by itself certify RFM, so we describe our own application controls separately and provide institution-specific evidence through a security review.

Encryption and recovery

RFM requires HTTPS for public integration endpoints. Laravel Cloud describes encryption in transit and at rest for its managed platform, as well as managed backup and recovery capabilities for supported data services.

RFM uses encryption for sensitive retained application payloads where recovery is required, and one-way digests when a value must be verified without being stored in recoverable form.

• TLS protects application traffic in transit.
• Sensitive retained application values use Laravel’s authenticated encryption facilities where appropriate.
• Redeemable credentials and similar values can be stored as one-way SHA-256 digests rather than plaintext.
• Backup retention and restoration procedures are reviewed as part of the production operating plan, rather than assumed from a marketing claim.

Secure LTI launch

A learner does not reach the player just because an LMS sends a request. RFM validates the platform signature, issuer, audience, deployment, state, nonce, message type, role, and resource link before resolving any learning access.

• Registration and deployment are scoped to one institution.
• Each resource link maps to an explicit published course version, never a mutable draft or latest-version lookup.
• The learner receives a short-lived, single-use RFM handoff rather than a reusable LMS token in a URL.
• Invalid, replayed, or unauthorized launches stop before player access.

Sensitive data stays out of the workflow

Private keys, provider secrets, raw JWTs, learner claims, grades, and access tokens are not placed in public documentation, URLs, fixtures, or ordinary support logs.

• Integration keys and secrets remain under backend ownership and managed-secret controls.
• Diagnostics use safe explanations and correlation values instead of raw launch payloads.
• The player consumes an RFM-issued session handoff and never parses raw LMS claims.

External identity

LTI identity is scoped to the registration and platform subject. Email may be absent or changed and is never used for automatic account merging.

Security review materials

We will make the public integration model, data-minimization principles, and hosting-platform information easy to evaluate. Institution-specific architecture, retention schedules, access controls, and operational evidence are shared through the appropriate security-review process.