Skip to content

Trust Center

Retenta holds education data on behalf of compliance-sensitive institutions. This page sets out how that data is handled, where it lives, and what happens in the cases that matter.

1. Architecture overview

Retenta connects to your Canvas instance with read-only access, exports your published courses, and writes them to immutable object storage in Australia. The data flow is: Canvas API → Retenta backup worker → Azure Blob Storage (Australia East) → your customer portal. We never write to your production Canvas instance.

2. Security posture

  • Data residency: all backup data is stored in Azure Australia East.
  • Immutability: backups are written to WORM (write-once, read-many) storage with a retention lock — they cannot be deleted or overwritten during the retention period.
  • Encryption: data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
  • Access: Canvas access is read-only and scoped via Microsoft Entra ID. Per-tenant credentials are isolated and rotated.

3. Data processing & sub-processors

Retenta collects the Canvas course content in your backup scope, plus the contact details you provide. We use a small set of sub-processors:

  • Microsoft Azure — backup storage and compute (Australia East)
  • Neon — application database
  • HubSpot — CRM for enquiries and contacts
  • Resend — transactional email
  • Cloudflare — DNS, TLS, and static site delivery

4. Data Processing Agreement & Privacy Policy

Our Privacy Policy describes how we handle personal information, including our Notifiable Data Breaches (NDB) obligations. A Data Processing Agreement is available to customers on request and is provided as part of contracting.

5. Business continuity

Because Retenta is a continuity product, we plan for our own. Your backup data is stored in your own Azure data residency region under immutable retention. If Retenta were to cease operating, your data remains accessible for the full retention period; we provide 90 days’ notice and an export window so you retain control of your records regardless of our status.

6. Insurance

Professional Indemnity and Cyber Liability insurance Certificates of Currency will be published here. They are available on request in the interim.

7. Entity details

Retenta is operated by Zac Simandl (t/as Retenta), Australia. ABN and company details are provided as part of vendor onboarding. For security or procurement queries, contact zac@retenta.io.