Quick answer
Your personal information is protected at every step. The course encrypts your data while it travels over the internet using TLS 1.2 or higher, and while it’s stored on our servers using AES-256 encryption through AWS Key Management Service.
We only collect what we need to confirm your identity and record your course completion with the Department of Licensing. We never sell or share your information for marketing.
In this article
- What information the course collects
- How we keep your data safe
- Who can see your information
- How long we keep your data
- The security standards we follow
- What to do if you suspect a problem
What information the course collects
We follow a Privacy by Design approach: we only collect the information needed to deliver the course and report your completion to DOL. Nothing more.
| Information we collect | Information we do not collect |
|---|---|
| Your WA.gov sign-in, so we know you are who you say you are. | Your WA.gov password — it stays with the WA.gov sign-in service and never reaches the course. |
| Your Washington Driver License Number, last name, and date of birth, used once to verify your identity through the DOL DRIVES system. | Your Social Security Number, payment information, or banking details — the course is free and never asks for them. |
| Your course progress (which lessons you finished) and knowledge check results. | Browsing activity on other websites, your contacts, or your location. |
| A unique support ticket if you contact our help desk, plus the information you provide when you reach out. | Photos, recordings, or biometric scans of you. The course does not use webcams or microphones. |
How we keep your data safe
The platform uses several layers of protection, working together. You don’t need to do anything to turn these on — they apply automatically every time you use the course.
| Protection | What it means in plain language |
|---|---|
| Encryption in transit (TLS 1.2 or higher) | Every page and form is sent over a secured connection, similar to a sealed envelope. No one watching the network can read what travels between your device and the course. |
| Encryption at rest (AES-256 via AWS Key Management Service) | Once your data is saved on our servers, it’s locked using the same strength of encryption that banks and government agencies use. The keys are kept separately from the data. |
| Strict access controls | Only team members who absolutely need access can see learner information. Every access is logged, and accounts are protected by multi-factor authentication. |
| Secure cloud infrastructure | The platform runs on Amazon Web Services across multiple data centers in the United States, so it stays available even if one data center has a problem. |
| Continuous security testing | Independent penetration testers try to break the platform at least once a year. Automated tools also check every code change for known weaknesses before it goes live. |
What about my WA.gov password?
Your WA.gov password is handled entirely by the Washington sign-in service. It’s never sent to the course platform, never stored by us, and never visible to support staff.
When you sign in, WA.gov verifies your password and tells the course “this person is signed in.” That’s all the course needs to know.
Who can see your information
Access to your information is tightly limited. Here’s exactly who has it and why:
- You. You can view your own course progress and completion record any time you’re signed in.
- Authorized DOL staff. DOL receives your completion record so it can be applied to your driver licensing record. Authorized staff can also help if there’s a problem with your data.
- A small number of our support and engineering staff. They may need to look at your account when you contact support or when troubleshooting a system issue. Every access is logged.
What we do not do with your information
- We do not sell your data.
- We do not share it with advertisers, insurers, or other third parties for marketing.
- We do not use it to train AI models.
- We do not contact you about anything other than this course.
How long we keep your data
Your course completion record is kept for as long as DOL needs it for your driver licensing record, in line with Washington State records retention rules.
- Course progress and lesson activity: kept while you’re actively enrolled, then archived.
- Completion record: transferred to DOL DRIVES and retained as part of your driver licensing record per state policy.
The security standards we follow
The course platform is built and operated against industry-standard security frameworks. These standards give independent benchmarks for how systems should be protected.
- NIST Cybersecurity Framework v1.1 — covering the five core functions of Identify, Protect, Detect, Respond, and Recover.
- Privacy by Design — building privacy protections into every part of the system from day one, instead of bolting them on later.
- OWASP Top 10 — the application is tested against the most common web security risks before every release.
- Secure software development lifecycle (SDLC) — every code change is reviewed for security and tested by automated tools.
- Independent penetration testing — at least once a year and after every major upgrade, results are shared with DOL.
What to do if you suspect a problem
If something doesn’t look right — for example, you didn’t take the course but it shows as completed, you see information that isn’t yours, or you suspect someone else used your account — let us know right away. We take every report seriously.
Quick things you can do now
- Sign out of the course on any shared device.
- Change your WA.gov password if you think someone else knows it.
- Never share your sign-in details, even with people who say they’re from DOL or our support team.
How to report a concern
- Contact our support team.
- Include what happened, when it happened, and any error messages or unexpected content you saw.
- If your account may have been used by someone else, change your WA.gov password before contacting us.
How we respond to security incidents
If we detect or suspect that learner data may have been exposed, our team notifies the Washington Department of Licensing within 24 hours of discovery. Affected drivers are informed as required by law, and a full incident report is provided to DOL within 10 business days.
Where to send security reports
If you want to report directly to DOL:
- DOL Information Services Division Security: dolitsecurity@dol.wa.gov
- Driver Licensing Customer Service: (360) 902-3900