Security & Data Protection
Last updated: 11 October 2026
USEMAGISTER is built with technical and organisational security measures suited to the service. This page describes the measures in place. It is not a security certification.
Data in transit and storage
• All traffic between your browser and USEMAGISTER is encrypted (HTTPS/TLS). • Passwords are stored only in one-way hashed form (bcrypt). Nobody, including us, can read them. • The database is hosted by MongoDB Atlas in the EU, with data encrypted at rest and regular backups. • Card details are handled by Mollie and never reach our servers.
Access control
• Role-based access: learners see their own data, trainers see only the learners and programs they are responsible for, and company administrators see only their own organisation. • Sign-ins use short-lived access tokens that are renewed automatically. • Sign-in attempts, registrations and AI use are rate-limited to stop misuse. • When administrators open learners' AI Coach conversations, it is logged.
AI and uploaded images
1. An image is uploaded to our server in the EU and checked for file type and size. 2. It is sent to Google (Gemini API) for analysis. Google does not use the content to train its models. 3. Our AI server does not keep the image after the analysis. 4. The result (hazards, course and quiz) is stored with the user's scan, and only the user, the responsible trainers and administrators can see it. We ask users not to photograph people or confidential information.
Monitoring and incidents
Errors and suspicious activity are logged and monitored. If a personal data breach occurs, we notify the Norwegian Data Protection Authority within 72 hours and inform affected users when required by the GDPR.
Subprocessors
The providers we use, and what they do, are listed in our Privacy Policy. We have, or are establishing, data processing agreements with each of them.
Reporting a security issue
If you believe you have found a security weakness, email support@usemagister.com. Please do not test in ways that could harm other users or their data.