Tenant isolation
ReadyThe runtime separates each institution. Content, attempts, and exports do not move between tenants.
Assessment security and reliability
QFlowLearn separates tenant data, signs launches, preserves published versions, and records attempt events so institutions can verify delivery and investigate results.
Check your institution's data requirements
Include required hosting locations, identity-provider rules, access roles, retention, deletion, and incident contacts in your technical review. Confirm these for the service and agreement you plan to use.
Content portability and geographic data residency are different requirements. An open export format does not establish where a service stores or processes data.
Review content ownership and exports → Send security and hosting requirements →Security and reliability controls
Signed launch and bootstrap
ReadyQFlowLearn signs each launch token and limits its duration. The edge service verifies the bootstrap before it gets the package.
Immutable content versions
ReadyQFlowLearn does not change a published version. A correction creates a new version. Each attempt keeps its version reference.
Attempt event ledger
ReadyQFlowLearn adds each attempt event to a ledger. The events include start, item view, response, navigation, accommodation, and submit.
Operational audit
ReadyThe runtime records rescoring, version overlays, and evidence exports.
Recovery plan
ReadyThe recovery process uses IndexedDB recovery storage, durable submit records, and attempt reconciliation.
Cloudflare platform services
ReadyWorkers, Durable Objects, Queues, R2, and the global edge each have a defined role in launch, delivery, submission, evidence, or export.
Data retention and redaction
Evidence in progressQFlowLearn documents retention periods and redaction rules for each evidence type.
Public hostnames
QFlowLearn separates marketing, authoring, and learner delivery by hostname. Each host has its own authentication, asset, and cross-origin resource sharing (CORS) rules.
qflowlearn.com
This host contains marketing, RFP, and evidence pages. Cloudflare Workers runs the site.
app.qflowlearn.com
This host contains the authoring application. It has host authentication and a specified CORS allowlist.
take.qflowlearn.com
This host contains the learner delivery runtime. It uses launch tokens and does not use marketing cookies.
Request the architecture summary
QFlowLearn will send the architecture summary, runtime contract, retention rules, redaction rules, and launch artifact list for your security review.