Customer Academy Compliance: SCORM, SSO, SOC 2, and GDPR Basics

Compliance is the least glamorous part of building a customer academy. It is also the part that determines whether an enterprise deal closes or gets stuck in security review for a quarter.

Most CX leaders underinvest here because compliance feels like a job for legal, and legal feels like a job for someone else. It is a product decision. The features that satisfy compliance are the features that unlock enterprise revenue.

What compliance capabilities does an academy actually need?

Four, ranked by how often they come up in enterprise security reviews.

1. SSO. Almost every enterprise buyer asks. Non-negotiable above 500-employee accounts.
2. SOC 2 Type II. Standard security posture. Requested in most enterprise RFPs.
3. GDPR-compliant data handling. Required if any of your customers or their learners are in the EU or the UK.
4. SCORM export. Requested when the customer has a corporate LMS and their L&D team mandates that courses run inside it.

Ship the first three at or near launch. SCORM is often a fast-follow, brought in when three or more enterprise pipeline deals have asked for it.

Why does SSO matter so much for a customer academy?

Because your learners are already logged into your product. Making them create a second password destroys enrollment rates.

• Access without friction. A learner clicks the enrollment email, is redirected to the identity provider, and lands in the academy already authenticated. No password creation, no friction.
• Provisioning and deprovisioning. When a customer offboards an employee, their academy access disappears the same day. Without SSO, ex-employees keep access indefinitely.
• Enterprise procurement checkbox. SSO is table stakes above 500-employee accounts. Not offering it is a discussion-ending answer in some RFPs.

Support SAML 2.0 and OIDC. Test against Okta, Microsoft Entra, and Google Workspace. That covers roughly 90 percent of enterprise identity providers.

What does a SCORM export actually contain?

SCORM is a packaged version of your course that a corporate LMS can host and track.

• The package. A ZIP file containing your video files, quiz content, metadata, and a manifest file describing the course structure.
• The tracking. The LMS records completion, quiz scores, and pass or fail status. Data does not flow back to your academy platform unless you build a separate integration.
• The trade-off. You lose visibility into learner engagement. You gain the ability to sell into customers whose L&D teams require in-house hosting.

Not every customer needs SCORM. But when procurement asks, "no" is often a deal-breaker. Ship SCORM 1.2 export first (broadest LMS support), then 2004 (richer tracking) if enterprise deals demand it.

Which SSO providers should you support at launch?

Cover the top four and expose the underlying protocols for the rest.

Do not build one-off integrations per customer. Expose SAML and OIDC endpoints and let the customer admin configure their side. Provide setup documentation and a test harness. Reserve custom integration work for enterprise deals that pay for it.

What SOC 2 controls apply to a customer academy specifically?

Five that come up more than the others.

• Access controls. Who at your company can log in to the academy admin console and what can they see. Least privilege enforced through role-based permissions.
• Change management. How course content changes are reviewed and deployed. Audit log required.
• Vendor management. If your academy platform uses subprocessors for video hosting, analytics, or email, they need to be in your vendor list with SOC 2 or equivalent evidence.
• Data encryption. In transit (TLS 1.2 minimum) and at rest (AES-256 or equivalent). Both are standard now; missing them is a red flag.
• Incident response. A documented process for security incidents, including notification timelines for customers.

If your academy platform is already SOC 2 Type II certified, you inherit most of these controls. If not, plan for a 6 to 12 month audit cycle before you can close deals that require it.

How do you handle GDPR for learner data?

Four learner rights, plus data residency.

• Right of access. Every learner can see their own record, including completion status and quiz scores, without asking your team.
• Right to portability. Every learner can export their record as CSV or JSON. Provide a self-serve download from the learner profile page.
• Right to erasure. Every learner can request deletion. Honor within 30 days of the request. Route the request through the customer admin so account-level records are not silently destroyed.
• Right to object. Every learner can opt out of enrollment emails without losing academy access.

For data residency, offer EU-based hosting as an option for customers with EU learners. Not required by GDPR itself, but frequently requested. Document your subprocessors and their locations in your DPA.

What belongs in your Data Processing Addendum?

Cover eight sections at minimum.

1. Nature and purpose of processing (customer education).
2. Categories of data (learner name, email, completion data, quiz scores).
3. Categories of data subjects (customer employees enrolled in the academy).
4. Subprocessor list, including video hosting, analytics, email delivery.
5. Data retention policy (typical: 18 to 36 months after last activity).
6. Data breach notification timeline (typical: within 72 hours of confirmation).
7. Learner rights procedures for access, portability, erasure, and objection.
8. Data residency options if applicable.

Templates exist. Use one, adapt it, have legal review it. Do not write from scratch.

Which compliance capability drives the most enterprise revenue?

SSO, by a large margin.

• SSO. Blocks or unblocks a huge share of enterprise deals. Missing it is a discussion-ender in many RFPs.
• SOC 2 Type II. Blocks deals in regulated industries and above a certain deal size. Below the threshold, buyers often accept the platform's certification instead of yours.
• GDPR compliance. Required for EU customers. Not optional. But once shipped, it does not need to be sold; it just needs to be documented.
• SCORM. Unblocks specific deals where L&D mandates in-house LMS hosting. Less common than the others but critical when it applies.

Ship in that order. SSO first, SOC 2 posture next, GDPR before your first EU customer, SCORM when enterprise pipeline demands it.

What are the common compliance mistakes?

Three that stall deals.

• Treating compliance as a launch blocker. You do not need SCORM at launch. You do not need SOC 2 at launch. You need SSO and a credible plan for the rest. Ship the plan, not the completed audit.
• Trying to build SSO per customer. Custom integrations per identity provider will consume the engineering team. Expose SAML and OIDC and let customers self-configure.
• Ignoring subprocessors. Your video host, email provider, and analytics platform are subprocessors. Missing them from your DPA is caught immediately in security reviews.

Fix these three and you will not lose enterprise deals for compliance reasons in the first year.

The mistake to avoid

Treating compliance as a legal problem instead of a product problem. Compliance capabilities are features. SSO, SOC 2, GDPR handling, and SCORM export are the four features that unlock enterprise revenue for a customer academy. They should sit on the roadmap next to course builder and enrollment rules, prioritized by the deal size they gate. A CX leader who ships an academy without SSO will lose the first enterprise deal that comes to security review. A CX leader who ships an academy with SSO and a credible compliance roadmap will close deals that competitors cannot even respond to.