Vendor Diligence

We collect zero end-client PII. Your clients can use the course without an account, a login, or giving us any personal information at all.

There is no signup for your clients, no login, and no form anywhere that asks them for personal details. The only input field on the public site takes a license access code — a code issued to your institution, not to a person. Browsing the public pages (home, course overview, pricing, poster previews, this page) collects nothing from the visitor.

No analytics and no trackers

We run no analytics or measurement tools, no advertising, and no social-media pixels. There is no cross-site tracking and no visitor profiling. Because we keep no visitor history, there is nothing to export, correct or delete on request.

The only cookie: a signed session cookie for the licensed course

The course modules and the printable poster downloads are licensed content. Your clients unlock them with the code your institution gives them. The code is checked on our server — never in the browser — and if it is valid we set a single cookie:

• Name: bga_access
• What it holds: an HMAC-signed note naming the institution whose course is unlocked (so the course can greet the client with your institution's name) and when the session expires. It contains no name, no email address, no account number, no IP address, and no identifier that points to a person.
• How long: it expires on its own after 8 hours.
• Attributes: HttpOnly (page scripts cannot read it), SameSite=Lax, and Secure when the site is served over HTTPS.

Licence validation and codes: server-side configuration, no database

Licence validation runs entirely on our server; the client bundle cannot check a code itself. Licence codes are held as server-side configuration — the code paired with the institution name shown in the unlocked course. There is no database behind this site and no store of end-client records. When a licence ends, the code stops working as soon as we remove it from that configuration.

The little we do receive

• If your staff email us: we see that email address and whatever is written or attached, plus our replies.
• From Stripe, on a purchase: the ordinary order information a seller receives — the product, the amount, the purchaser's email address, and the transaction record — used only to set up and support your licence.
• Hosting plumbing: to deliver a page, our host's servers necessarily process standard technical request data such as IP address and browser type, and may keep short-lived request logs for security and reliability. We run no analytics over it and do not use it to identify anyone.

The full detail, including retention and how to contact us about data, is in our Privacy Policy.

Checkout is Stripe-hosted. The licence buttons on our pricing page open a Stripe checkout page, and the transaction is completed entirely on Stripe's platform. Stripe handles and stores the card data; we never see, receive or store card or bank-account numbers, and this site never collects them.

What we receive from Stripe is the same order information any seller gets — what was purchased, the amount, and the purchaser's email address — and we use it only to issue your licence code and to support the licence. Stripe's own handling is governed by Stripe's privacy policy. Billing terms, refunds and acceptable use are in our Terms of Service.

The site is served over HTTPS and hosted on Vercel. It is deliberately small: static and server-rendered pages with no user accounts, no file uploads, and no end-client data store. There is no database of client information to breach, and no end-client credentials exist for an attacker to steal.

The access cookie is signed server-side with an HMAC, so a browser cannot forge, edit, or mint one; the only thing inside it is an institution name and an expiry time. Gated content is refused when the code is absent or invalid: course pages redirect to the access page and poster PDF downloads return a 403. Because verification is server-side, there is no client-side check to bypass.

Licence codes are issued manually by us and are tied to the institution that licensed the program, so access can be scoped and withdrawn. We do not publish an audit badge or attestation, because we do not hold one — we would rather give you the facts above than a logo.

We will complete your security questionnaire and sign a data-processing agreement (DPA) on request. We do not keep a pre-signed template to hand over, so send us your form or your terms and we will work through them with you — including written confirmation of the points on this page for your vendor file.

Ask us questions about any of the above, or request the questionnaire or DPA, by emailing bankguard-academy-c68468aa@ctomail.io. We answer vendor queries directly.

• Terms of Service — what an annual licence covers, client tiers, the 30-day money-back guarantee, acceptable use, data and privacy, and liability.
• Privacy Policy — the full data-handling detail, including retention.
• Accessibility Statement — how the course and printable materials are made usable for everyone.

This page describes our own vendor posture only. It is not legal advice, and the course we publish is fraud-prevention education — not financial, legal, or investment advice.