edaptLEARN
Free AI tutoring platform for K-12 students
Allowlist request — edaptlearn.com
Edapt is a free, ad-free educational platform that adapts study material to a student's VARK learning style (Visual, Auditory, Reading/Writing, Kinesthetic). This handout summarises everything an IT team needs to add Edapt to your web-filter allowlist and SSL deep-inspection bypass list.
Action required
- Allowlist
edaptlearn.comand*.edaptlearn.comin the web filter (categorise as Education). - Add to SSL deep-inspection exemption list (FortiGate menu: Security Profiles → SSL/SSH Inspection → Exempt from SSL Inspection). This resolves
NET::ERR_CERT_AUTHORITY_INVALIDon student devices.
Domains
| Host | Purpose |
|---|---|
edaptlearn.com | Main app + marketing site |
*.edaptlearn.com | Subdomains (auth, api, status) |
api.stripe.com, js.stripe.com, checkout.stripe.com | Payment processing (Stripe) |
accounts.google.com | Google Sign-In (OAuth) |
api.groq.com, api.cerebras.ai | LLM inference (zero-retention) |
api.elevenlabs.io | Text-to-speech for Listen mode |
Security posture
Transport
TLS 1.3 site-wide · HSTS preload-eligible (max-age=2y, includeSubDomains) · HTTP/2 + HTTP/3Data at rest
Encrypted PostgreSQL (AES-256) · Encrypted backups · Encrypted object storageAuth
Bcrypt-hashed passwords · Signed short-lived JWTs · CSRF tokens · Stripe handles all card dataAI vendors
Groq + Cerebras under zero-retention / no-training enterprise termsPrivacy
No advertising · No third-party tracking · No model training on user content · APP-compliant (AU)Disclosure
RFC 9116 security.txt · OAIC NDB-compliant · 48hr ack on responsible disclosureVerify (publicly)
| Privacy policy | https://edaptlearn.com/privacy |
| Security disclosures | https://edaptlearn.com/security |
| Subprocessor list | https://edaptlearn.com/for-schools |
| security.txt (RFC 9116) | https://edaptlearn.com/.well-known/security.txt |
| SSL Labs report | https://www.ssllabs.com/ssltest/analyze.html?d=edaptlearn.com |
| Mozilla Observatory | https://observatory.mozilla.org/analyze/edaptlearn.com |
Why SSL deep-inspection breaks Edapt
Edapt uses Google OAuth and Stripe, neither of which accept man-in-the-middle re-signed certificates on personal (BYOD) devices. Adding Edapt to the same exemption list you already use for accounts.google.com, login.microsoftonline.com and bank domains resolves the NET::ERR_CERT_AUTHORITY_INVALID error students see.