Who operates intle
EDTECHLAB LTD, company 17103855, registered in England and Wales. Our legal and privacy documents are linked below.
Honest security, privacy and AI facts for intle.
This centre states what is implemented today, what is verified, and what is still being confirmed. We do not present planned audits or certifications as completed.
AI and processor disclosures reviewed: 30 September 2026
Verified EU data layer
Database, authentication and storage run on our own servers in Germany, using self-hosted Supabase software. Sentry is verified in its EU region in Germany. Backups are encrypted separately; full-disk encryption of the live database volume is not yet in place.
AI inference split
AI inference is treated as outside the UK/EU by default. Provider API no-training defaults and creator review are described in our AI transparency page; workspace data controls and agreement evidence are still being confirmed.
Still being confirmed
Resend, Inngest, Stripe, Cloudflare, and AI workspace data-control settings remain marked as being confirmed until dashboard checks are complete.
Security controls implemented today
- Supabase/Postgres row-level security on app tables, with May 2026 policy hardening.
- Burst rate limits on AI generation, editing, uploads, tracking, hosted-session responses, and contact routes.
- Magic-byte upload verification, extension/signature mismatch rejection, and OOXML decompression-bomb caps.
- SSRF guards for user-supplied URLs: HTTP(S) only, no credentials, no private/internal/metadata hosts, redirects rechecked, and 5 MB cap.
- CSRF Origin/Sec-Fetch checks on state-changing API routes, excluding signed server-to-server webhooks.
- HMAC-signed hosted-session participant cookies for participant track, respond, and finish endpoints.
- Sentry redaction drops request bodies, strips sensitive headers, redacts emails/JWTs/Stripe keys/UUIDs, and keeps sendDefaultPii disabled.
- Hosted-session passwords are bcrypt-hashed; account authentication is passwordless magic-link/SSO rather than stored account passwords.
Compliance roadmap
| Item | Status | Target |
|---|---|---|
| Cyber Essentials Plus | In progress | Target window: July-Oct 2026 |
| External penetration test | Planned | Target window: July-Oct 2026 |
| WCAG 2.2 AA accessibility audit | Planned | Target window: July-Oct 2026 |
| ISO 27001:2022 programme | Planned | Scope and target date to be confirmed after CE+/pen-test work |
Trust documents
Data Processing Addendum
The standard Article 28 terms for customer-controlled personal data processed through intle.
Sub-processors
Who helps provide the service, what data they touch, and which regions are verified.
AI transparency
Current model registry, what reaches AI providers, retention, and human review controls.
Accessibility
Current accessibility work, known limitations, feedback route, and audit roadmap.
LMS compatibility evidence
Evidence matrix for SCORM package checks and LMS validation status.
Security questionnaires
For institutional due diligence, review the standard DPA and contact us with your questionnaire, procurement deadline, or any required negotiated terms or security evidence.
Email admin@intle.co.uk