Security at Wooclap

Wooclap's security approach is a long-term project developed in collaboration with universities and businesses.

At Wooclap, we require and have developed the highest level of security for your data. This approach is continuously evolving with a dedicated security team working to increase our security level. You can find details of our security measures in our Security Policy, as well as on this page, which aims to share information on the main security topics.

The information provided here is valid for both Wooclap and Wooflash. These products are built on the same technical base and developed by the same team. Therefore, Wooclap's security guarantees also apply to our product Wooflash.

All data collected by Wooclap uses or in forms are processed on our servers hosted on Amazon Web Services (AWS). The servers are located in a country of the European Union ("eu-west-3" region in Paris, France), and are therefore subject to the GDPR.

Why AWS? We chose to work with Amazon because they are industry leaders in terms of quality of services, security features and technologies and are fully compliant with GDPR. These criteria are essential for us, for AWS, but also for all the partners we are working with.

Our infrastructure is built on AWS and based on the AWS Well-Architected Framework which includes the highest security configuration standards and data protection pillars.

All Wooclap data are encrypted At-rest and In-transit. Privacy and data protection are important topics for Wooclap. To achieve these goals, we use data encryption measures wherever possible.

At-rest encryption: Wooclap uses Amazon Key Management Service (KMS) with AES 256-bit keys to encrypt data stored by Wooclap. This data encryption scheme has been validated as FIPS 197 by the NIST. Regarding the key storage, AWS uses specific equipment called Hardware Security Module (HSM) — this device guarantees that no technical access is possible to the keys for AWS, Wooclap or anyone else.

In-transit encryption: Only TLS 1.2 or higher is used at Wooclap. This asymmetric cryptographic algorithm allows Wooclap to encrypt and prevent attacks on communications between Wooclap services and the users' browsers.

An AWS video explains the specific encryption mechanisms and AWS services that protect Wooclap data.

At Wooclap, we prioritise enhanced authentication methods such as Single Sign-On (SSO), although basic authentication is still possible.

There is only one type of account at Wooclap, whether they are participants, teachers, presenters, etc., but different types of rights are possible:

• Normal rights, which allow creating content, events, etc.
• Administrator rights as "pedagogical engineer", which provides access to their organisation(s).
• Administrator rights as "moderator", which provides access to their organisation(s) and the ability to add or remove users from it.
• Wooclap administrator rights, which provide access to "pedagogical engineer" and "moderator" privileges, as well as configuration options for SSO and detailed access to organisations.

Wooclap users can access their accounts through various authentication methods:

• Email and password authentication
• Social media authentication
• Enhanced Single Sign-On (SSO) authentication, where a technical connection with Wooclap will be required with your professional email (which will redirect to your company or institution's SSO page)

Wooclap supports various authentication protocols, particularly those related to the education sector:

• RENATER (Le Réseau National de Télécommunications pour la technologie, l'Enseignement et la Recherche)
• The International EduGAIN service
• The GÉANT Data Protection Code of Conduct
• RedIRIS

But also more common or region-specific protocols: Azure AD, SAML, CAS, Shibboleth, Apereo, Canarie.

Please do not hesitate to contact us directly to find out if your authentication protocol is available.

Wooclap is also compatible with most Learning Management Systems (LMS): Moodle, Canvas, Blackboard, Brightspace D2L, Claroline, Dokeos, itslearning, Sakai, etc.

LMS authentication can be done using Learning Tools Interoperability (LTI) protocols:

• LTI 1.1 for symmetric encryption (obsolete since late 2021)
• LTI 1.3 for asymmetric encryption with OpenID Connect - OAuth 2.0

Authentication with the Moodle plugin is also possible.

Regarding access to Wooclap data for Wooclap employees, access is strictly limited, and only Tech team members can access user data for specific purposes (such as bug investigation and resolution).

Wooclap employees' accesses with administrator rights are protected by Single Sign-On (SSO) and also require Multi-Factor Authentication (MFA).

AWS prohibits and has systems designed to prevent access by AWS personnel to data stored on AWS for any purpose, including service maintenance. Individual access to maintenance must be specifically granted by a Wooclap employee with the right level of rights. Those accesses are covered by extra security measures such as Identity Access Management (IAM) Policies to grant access to only authorised Wooclap accounts.

Wooclap chose AWS infrastructure to ensure the highest level of service for users and customers. A Service Level Agreement (SLA) document is available and attached to your Wooclap contract, which highlights the platform's SLAs with details on availability rates, support, and critical situations or incident answers.

Wooclap has an incident management procedure and an action checklist to follow, which is shared by the company's management and board. It is an internal document that describes roles, actions to be taken, and priorities in the event of an incident. The post-remediation phase is also described so that actions can be taken to prevent the incident from recurring (if possible).

Protection against Distributed Denial of Service (DDoS) attacks is mitigated by AWS mechanisms. This continuous network monitoring blocks malicious traffic using packet filtering and traffic shaping based on priorities at Layers 3 (IPv4/IPv6) and 4 (TCP/UDP) of the OSI model.

Wooclap has dedicated insurance for security incidents.

We will always be transparent and communicate if any consequences affect the use of the Wooclap platforms or user data. We see communication as a duty and it's also mentioned in the contract that binds both parties.

Wooclap uses two methods to ensure that there is no data loss for users:

• Daily backups that are encrypted (AES-256) and stored for 30 days
• Snapshots (copies of the entire disk file system at a given point in time)

Both methods allow Wooclap to revert to a previous healthy state in case of accidental or malicious alteration or destruction of data.

Secure development best practices (security by design) are implemented at Wooclap and are part of our platform's development cycle. More details are available in our Security Policy (linked to your contract).

Wooclap implemented monitoring and alerting measures based on AWS technologies but also dedicated tech team tools.

Logging measures are used continuously by the development teams. Application logs are kept 6 months following the ANSSI and CNIL recommendations.

Wooclap performs an annual security audit on its infrastructure to detect new vulnerabilities and implements every necessary remediation following this audit.

Audits might be a technical penetration test on the Wooclap applications and websites or on a wide scope with compliancy or organisational layer.

Wooclap partners and clients with an organisational Wooclap license can also request a specific audit on our infrastructure (limited to one audit per year and funded by their organisation).

Audit summaries can be shared with clients upon request.

Wooclap has a security governance team with the Chief Information Security Officer (CISO) and the CTO of Wooclap. This team is known by all Wooclap employees, with frequent communication.

Wooclap has an annual security roadmap to anticipate and plan upcoming security and data privacy improvements. More specific goals are also linked to this roadmap to track progress and continuous alignment with the company's targets.

The Wooclap Security team is also responsible for the security relationships with university partners and other Wooclap clients. We respond to security forms, answer to legal aspects and sign contracts. This relationship is maintained throughout the contract lifecycle.

Wooclap has a Security Policy as well as other documents related to security and data privacy. These documents are included as annexes to the contract.

Awareness actions are carried out throughout the year at Wooclap and gathered through an annual program. Security training is mandatory during the onboarding process of each new Wooclap employee.