Grow LMS API Documentation

Grow by Plenum — Security & Data Governance

The security posture behind your Grow environment, for IT security, privacy, and procurement review.

This document consolidates, in one place, what your information-security and vendor-risk teams need to evaluate Grow by Plenum: where data lives, how it’s protected in transit and at rest, how access is controlled, how payment and personal data are handled, and what governance applies over the lifecycle. Where a formal artifact (attestation, DPA) is the right answer, we say so and provide it through procurement.

Throughout, <SCHOOL_ID> is your dedicated Grow environment.

1. Summary for a vendor-risk review

The sections below expand each of these.

2. Hosting and certifications — stated precisely

Grow is hosted on Google Cloud Platform. GCP maintains SOC 2, SOC 3, and ISO 27001 certifications for its infrastructure, and Grow runs on that certified foundation — inheriting the physical, network, and platform-level controls those programs cover.

We want to be precise about scope, because your security team will be: these are certifications of the underlying cloud infrastructure. They mean the data-center, hardware, and platform layer your environment runs on are independently audited to those standards. Where your review requires attestation at the application or processor level, the right artifact is a Data Processing Agreement and the specific documentation we can provide through procurement — name what your process needs and we’ll route it. We’d rather scope this accurately than let an infrastructure certification stand in for something it isn’t.

3. Data protection

In transit. All connections — learner sign-in, administrative access, and every API and webhook call — are encrypted with TLS 1.2.

At rest. Data is stored on GCP’s managed storage layer, which provides encryption at rest as part of the platform.

Tenancy and isolation. Your organization runs in a dedicated <SCHOOL_ID> environment with its own credentials. API credentials issued for your environment authenticate to it and nothing else — there is no shared, cross-client key. Isolation is structural, not a matter of configuration policy.

4. Access control

System access (API). Machine-to-machine access uses OAuth2 with a client ID and secret scoped to your environment, presented as a bearer token on every request (see Authentication & Access Setup). Credentials are independently revocable and rotatable with no downtime, supporting a clean response to personnel change or a suspected compromise.

Human access (SSO). People authenticate through your own identity provider via SAML or OIDC, brokered by a Plenum-managed identity layer (see SSO & Identity Integration). This keeps access governance where you already run it — disable someone in your directory and their ability to sign in goes with it.

Administrative roles. Within Grow, administrative capability is role-scoped (admin, reporter, seat_manager, and others), so you can grant least-privilege access to your own staff rather than all-or-nothing administration.

5. Payment data

If any part of your program involves paid enrollment, card data never touches the learning platform. Payment handling is offloaded entirely to dedicated, PCI-compliant processors (Stripe / PayPal); the platform records that a transaction occurred but does not store or process card details. This keeps payment-card scope off the LMS layer and with the specialized processors built for it.

For most workforce-compliance programs this is moot — enrollment is sponsored by the organization — but it’s part of the posture for completeness.

6. Personal data and privacy

What’s held. A learner record contains personal data necessary to deliver and evidence training: identity and contact details, role, tags/attributes you assign, custom fields you define, and the training history (progress, completions, certificates) that constitutes the compliance record.

Data-handling signals. Records carry indicators relevant to privacy obligations — for example, a flag indicating whether a learner is located in Europe — so data-handling can reflect the applicable regime.

Your data is yours. The training and personal data in your environment is your organization’s. Through the API and webhooks (see Pull-Based Data Access) you can extract a complete copy of it at any time, which supports your own retention, backup, and data-subject-request processes.

Governance artifacts. A Data Processing Agreement governing how Plenum processes personal data on your behalf is available through procurement. Specific data-residency, retention, and deletion requirements are confirmed with your privacy team during onboarding.

7. Lifecycle and retention

• Deprovisioning. Access is cut by suspending a learner via the API and/or disabling them in your IdP (see Provisioning & Workforce Management). Suspension preserves the historical compliance record while removing access — usually what an audit trail requires.
• Record retention. Because you can extract the full record set on demand, your warehouse can be the long-term system of record on whatever retention schedule your policy dictates, independent of the platform.
• Deletion requests. Hard-deletion of personal data to satisfy a data-subject request is handled as part of the governance process confirmed at onboarding.

8. What we’ll provide for your review

To support a formal vendor-risk or security review, ask your Plenum engagement lead for:

• A Data Processing Agreement (DPA).
• The infrastructure attestation documentation applicable to the hosting platform.
• A walkthrough of the authentication, signing, and isolation model described above, mapped to your specific control questionnaire.

We’d rather answer your actual questionnaire directly than hand over a generic packet — send it across and we’ll respond to it line by line.

9. Where to go next

• Authentication & Access Setup — the system-authentication detail behind Section 4.
• SSO & Identity Integration — the human-authentication and access-governance model.
• Webhooks — the signed-event integrity model referenced in Section 1.

Prepared by Plenum Solutions for your evaluation. “Grow by Plenum” is operated and supported by Plenum on your behalf. Formal security and privacy artifacts are provided through procurement. For security review support, contact your Plenum engagement lead.