Privacy Policy
Last updated: June 20, 2026
1. Introduction
4Shore Solutions, LLC ("we", "us", "our") operates Blast Radius Lab ("the Service"), an interactive SRE training platform. This Privacy Policy explains how we collect, use, store, and protect your personal information.
By using the Service, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
Account Information: When you create an account, we collect your first name, last name, email address, and a password (stored as a one-way hash — we never store your plaintext password).
Learning Progress: We track which phases, tasks, and quiz questions you've completed, and your current phase in the curriculum.
Chat Transcripts: Conversations with the AI mentor are logged for quality assurance and compliance monitoring. Transcripts are associated with a hashed version of your email address.
Payment Information: If you purchase a paid tier, payment processing is handled entirely by Stripe. We store a Stripe customer ID to associate payments with your account, but we never store credit card numbers, CVVs, or full payment details.
AWS Credentials: If you reach Phase F, a dedicated AWS account is provisioned for you. IAM credentials (access key ID and secret access key) are stored in our database to display on your dashboard. These are scoped to the lab environment only.
3. How We Use Your Information
- To provide and operate the learning platform
- To track your progress through the curriculum
- To process payments and manage your subscription tier
- To send transactional emails (welcome, phase completion, account changes)
- To provision and manage AWS lab infrastructure on your behalf
- To monitor chat interactions for compliance and quality (automated agents review transcripts for policy violations)
- To improve the AI mentor's teaching effectiveness
4. Legal Basis for Processing
We process your personal data under the following legal bases (GDPR Article 6):
- Contract: Processing necessary to provide the Service you signed up for (account management, progress tracking, AWS provisioning)
- Consent: Where you have given explicit consent (e.g., creating an account, providing payment information)
- Legitimate Interest: Quality assurance, security monitoring, and improving the platform — balanced against your privacy rights
5. Data Storage and Security
- Passwords are hashed using PBKDF2-SHA256 with a unique salt per user
- All data is transmitted over HTTPS/TLS encryption
- Authentication uses JWT tokens stored in HTTP-only cookies
- Chat logs are stored in AWS S3 with server-side encryption
- AWS learner credentials are stored encrypted at rest in our database
- The platform runs on AWS infrastructure in the US-East-1 region
6. Data Retention
- Account data: Retained for the life of your account. Permanently deleted upon account deletion request.
- Learning progress: Retained for the life of your account.
- Chat transcripts: Retained for up to 1 year for compliance purposes, then automatically purged.
- AWS accounts: Lab AWS accounts are torn down after a period of inactivity. Infrastructure you deploy is ephemeral and not intended for production use.
- Payment records: Stripe retains payment records per their own retention policy. We delete your Stripe customer record when you delete your account.
7. Third-Party Services
We use the following third-party services that may process your data:
- AWS (Amazon Web Services): Infrastructure hosting, S3 storage for chat logs, and dedicated learner accounts for Phase F
- Stripe: Payment processing for paid tiers. See Stripe's Privacy Policy
- AI Model Provider: A third-party AI model provider powers the mentor. Chat messages are sent to the provider's API for response generation. The provider processes data under a data processing agreement and does not use your data for model training.
- Resend: Transactional email delivery (welcome emails, phase completions, account notifications)
8. Your Rights
Under GDPR and applicable privacy laws, you have the right to:
- Access: Request a copy of all personal data we hold about you. Use the "Download My Data" button in Settings.
- Correction: Request correction of inaccurate personal data.
- Deletion: Request permanent deletion of your account and all associated data. Use "Delete My Account" in Settings. This will also tear down any provisioned AWS infrastructure and cancel your Stripe customer record.
- Data Portability: Receive your data in a structured, machine-readable format (JSON export).
- Withdraw Consent: You may close your account at any time.
To exercise any of these rights, visit your Settings page or contact us at info@blastradiuslab.com.
9. Cookies
We use the following cookies:
- br_session: An HTTP-only authentication cookie containing your encrypted session token. Required for the Service to function. Expires when your session ends or after the configured session duration. Always active (essential).
- cookie_consent: Stores your cookie preference (accepted or rejected). Expires after 1 year. Always active (essential).
- Google Analytics (via gtag.js): If you accept analytics cookies, we use Google Analytics (measurement ID: G-5D9W0JWFHC) to understand how visitors use the site. Google may set cookies such as
_ga and _ga_*. These are only loaded after you consent. You can withdraw consent at any time by clearing your cookies. See Google's Privacy Policy.
We do not use third-party advertising cookies.
10. International Users
The Service is hosted in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. We implement appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) where required.
11. Age Requirement
The Service is intended for users aged 18 and older. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us with personal data, please contact us immediately.
12. AWS Infrastructure & Learner Accounts
When you reach Phase F (CD to AWS), we provision a dedicated AWS account for your lab work. Important details:
- The AWS account is a sandbox environment within our AWS Organization, restricted by Service Control Policies (SCPs) and a monthly budget cap.
- The account is intended solely for completing the Blast Radius Lab curriculum. Any use beyond the lab exercises (production workloads, cryptocurrency mining, abuse, etc.) is prohibited and will result in immediate account termination.
- Lab AWS accounts are torn down after a period of inactivity. Any infrastructure you deploy is ephemeral.
- When you delete your Blast Radius account, your AWS lab account and all resources within it are permanently destroyed.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
For privacy-related inquiries, data requests, or concerns:
- Email: info@blastradiuslab.com
- Entity: 4Shore Solutions, LLC