Totara Talent Experience Platform

Security Compliance & Infrastructure Assessment Report

Document Version 1.0 - February 2026
Platform Version Totara TXP 18 - 19 -20
Prepared By Skillup MENA
Classification Confidential

Executive Summary

This comprehensive assessment confirms that Totara Talent Experience Platform (TXP) Version 19.0.5 is fully compliant with enterprise-grade cybersecurity standards and can be securely deployed within the Kingdom of Saudi Arabia. The platform implements multiple layers of security including Multi-Factor Authentication (MFA), SAML 2.0 SSO, role-based access control (RBAC), GDPR-compliant data handling, and comprehensive audit logging. Totara supports deployment on Saudi-based cloud infrastructure (AWS Middle East, Azure UAE, Oracle Cloud Jeddah, and local data centers) ensuring full compliance with data residency requirements mandated by Saudi regulations.

📋 Platform Technical Specifications

Totara Version
18-19-20
Build Number
20250523.00
PHP Support
8.1.x - 8.3.x
Database Support
PostgreSQL, MySQL, MSSQL
🔐

Cybersecurity Compliance Features

🔑

Multi-Factor Authentication (MFA)

Enterprise-grade MFA implementation with support for:

  • TOTP (Time-based One-Time Password)
  • Authenticator app integration
  • Factor escalation for sensitive operations
  • Per-user MFA enforcement policies
✓ Fully Implemented
🌐

SAML 2.0 Single Sign-On

Complete SAML implementation supporting:

  • Multiple Identity Provider (IdP) configurations
  • Automatic user provisioning
  • Single Logout (SLO) support
  • Assertion encryption & signing
  • Remote metadata refresh
✓ Enterprise Ready
🔗

OAuth 2.0 Integration

Modern OAuth 2.0 authentication supporting:

  • Microsoft Azure AD / Entra ID
  • Google Workspace
  • Custom OAuth providers
  • Linked login management
✓ Fully Supported
📁

LDAP/Active Directory

Enterprise directory integration with:

  • Microsoft Active Directory support
  • NTLM SSO authentication
  • Automatic user synchronization
  • Role mapping from AD groups
✓ Production Ready
👥

Role-Based Access Control

Granular permission management:

  • Hierarchical role system
  • Context-based permissions
  • Custom capability definitions
  • Multi-tenant support with audiences
  • Organisation-based restrictions
✓ Enterprise Grade
⏱️

Session Management

Secure session handling including:

  • Configurable session timeouts
  • Session key validation (sesskey)
  • CSRF token protection
  • Secure cookie handling
  • Concurrent session controls
✓ Secure by Default

🏗️ Totara Security Architecture

USERS LAYER Web Browsers | Mobile Apps | API Clients 🛡️ SECURITY LAYER HTTPS/TLS 1.3 WAF Protection MFA / TOTP SAML 2.0 SSO Session Security ⚙️ APPLICATION LAYER - TOTARA TXP Learn LMS Engage LXP Perform RBAC Engine GraphQL API Audit Logger 💾 DATA LAYER - SAUDI ARABIA HOSTED Encrypted Database | Secure File Storage | Automated Backups | Data Residency Compliant
🛡️

Data Privacy & Protection

Totara includes comprehensive data privacy tools designed to meet GDPR requirements and similar data protection regulations, ensuring compliance with Saudi Arabia's Personal Data Protection Law (PDPL).

✓
User data export functionality for data portability
✓
Data purge capabilities for right to erasure
✓
Configurable data retention policies
✓
User consent management tools
✓
Privacy policy acceptance tracking
✓
Activity and access audit trails
✓
Deleted user data anonymization
✓
Suspended user data protection
🇸🇦

Saudi Arabia Hosting Compliance

🏢 Data Residency Compliance

Totara fully supports deployment within the Kingdom of Saudi Arabia, ensuring compliance with local data residency requirements. The platform can be hosted on:

☁️

AWS Middle East (Bahrain)

Amazon Web Services with Bahrain Region (me-south-1) providing low-latency access to Saudi Arabia with compliance features.

Available
☁️

Microsoft Azure UAE

Azure UAE North and UAE Central regions with direct connectivity to Saudi Arabia and enterprise compliance certifications.

Available
☁️

Oracle Cloud Jeddah

Oracle Cloud Infrastructure with data center in Jeddah, Saudi Arabia for full data residency within the Kingdom.

✓ Saudi Based
🔵

Google Cloud (Jeddah)

Google Cloud Platform with Dammam region (me-central2) providing enterprise-grade cloud services with full Saudi data residency compliance.

✓ Saudi Based
⚡

Lightnode (Riyadh)

Lightnode cloud infrastructure with data center located in Riyadh, Saudi Arabia offering high-performance VPS and dedicated servers.

✓ Saudi Based
🏢

On-Premise / Local DC

Full support for on-premise deployment in customer-owned data centers within Saudi Arabia for maximum control.

✓ Full Control

🌍 Saudi Arabia Deployment Architecture

🇸🇦 KINGDOM OF SAUDI ARABIA Data Residency Compliant Zone 🔄 Load Balancer Web Server 1 Nginx/Apache Web Server 2 Nginx/Apache 💾 Database PostgreSQL/MySQL 📁 File Storage Encrypted S3/NFS 🔒 Encrypted Backups 👥 Saudi Users Low Latency Access HTTPS Encrypted 🔐 Identity Provider SAML/OAuth/LDAP AD Integration
💾

Backup & Disaster Recovery

📦

Course & Activity Backup

Comprehensive backup system supporting:

  • Full course backups with all content
  • Section-level backups
  • Individual activity backups
  • User data inclusion options
  • Multiple backup formats (Moodle 2, IMS CC)
✓ Built-in
🔄

Automated Backup System

Scheduled backup capabilities:

  • Configurable backup schedules
  • Automated execution via cron
  • Backup retention management
  • Email notifications on completion
  • Backup storage management
✓ Automated
🔐

Database Backup

Enterprise-grade database protection:

  • Full database dumps support
  • Incremental backup capability
  • Point-in-time recovery
  • Cross-region replication support
  • Encryption at rest and in transit
✓ Enterprise Grade
🚀

Disaster Recovery

Business continuity features:

  • Quick restore capabilities
  • Cross-site restore support
  • Backup validation tools
  • Recovery testing procedures
  • RTO/RPO optimization
✓ DR Ready

📊 Backup & Recovery Architecture

Production System Totara TXP 18-19-20 Database + Files Scheduled Backup Process 📦 Course Backup 💾 DB Dump 📁 File Sync 🔒 Encryption Primary Backup Saudi Region Secondary Backup DR Site Disaster Recovery Path Retention Daily: 7 days Weekly: 4 weeks Monthly: 12 months
💻

Operating System Compatibility

Totara TXP supports deployment on enterprise-grade operating systems, with full compatibility for Linux distributions commonly used in Saudi Arabian enterprises.

🐧
CentOS / RHEL
Version 8.x, 9.x
✓ Recommended
🐧
Ubuntu Server
20.04 LTS, 22.04 LTS
✓ Supported
🐧
Debian
11 (Bullseye), 12 (Bookworm)
Supported
🪟
Windows Server
2019, 2022
Compatible*

* Windows Server is compatible but Linux-based systems are recommended for optimal performance and security.

📋

Security Compliance Summary

Requirement Feature Status Notes
Authentication Security MFA/TOTP, SAML 2.0, OAuth 2.0, LDAP ✓ Enterprise-grade authentication options
Data Encryption TLS 1.3, Database encryption, File encryption ✓ Encryption at rest and in transit
Access Control RBAC, Context-based permissions, Tenancy ✓ Granular permission management
Data Residency Saudi Arabia hosting capability ✓ Multiple deployment options available
Audit Logging Comprehensive activity tracking ✓ Full audit trail for compliance
Data Privacy (PDPL) GDPR-compliant tools, data export/purge ✓ Meets Saudi PDPL requirements
Backup & Recovery Automated backups, DR capabilities ✓ Enterprise backup solutions
Session Security CSRF protection, secure sessions ✓ Built-in security mechanisms
API Security GraphQL with authentication, rate limiting ✓ Secure API architecture
OS Compatibility Linux (RHEL, CentOS, Ubuntu), Windows ✓ Enterprise OS support
⚙️

Technical Requirements

🌐

Web Server

  • Apache 2.4.x
  • Nginx 1.20+
  • IIS 8.x (Windows)
🐘

PHP Requirements

  • Recommended: PHP 8.2.x
  • Supported: 8.1.x - 8.3.x
  • Required extensions: intl, curl, gd, mbstring, openssl
💾

Database Support

  • PostgreSQL 13.x - 16.x (Recommended)
  • MySQL 8.0.x - 8.4.x
  • MariaDB 10.5.x - 11.4.x
  • MSSQL 2017, 2019
🔐

Security Extensions

  • OpenSSL (required for SAML)
  • Sodium (encryption)
  • Hash functions (bcrypt, argon2)