Security & Privacy Overview

1. Data protection & encryption

• In transit: all traffic is served over TLS/HTTPS, with certificates issued by Let's Encrypt and renewed automatically.
• At rest: the production database and backups are encrypted at rest.
• Credentials: passwords are hashed with bcrypt and are never stored in plaintext or logged.

2. Access control & secrets

• Least privilege: access to production systems and data is limited to authorized personnel on a need-to-know basis.
• Administrative access is protected by signed, time-limited sessions, constant-time credential comparison, and lockout after repeated failed attempts.
• Account protections: password-complexity requirements, lockout on repeated failed logins, and revocable session tokens.
• Secrets management: application secrets and credentials are injected as environment variables at deploy time. They are not committed to source control and are not embedded in application images.

3. Infrastructure & hosting

• Hosting: the Service runs on Vultr, in a containerized environment behind an nginx reverse proxy that terminates TLS.
• Availability: container health checks and automatic restart help keep the Service running.
• Data location: data is processed and stored in the United States.

4. Privacy & regulatory posture

• Our practices are aligned with FERPA (we act as a "school official"), COPPA (parental or school consent and data minimization for children under 13), GDPR, and CCPA.
• We do not sell personal information or student data, do not use it for third-party advertising, and do not use student data to train external AI models.
• Data retention is defined, and deletion requests are honored — for individuals, parents, and schools.
• Full details are in our Privacy Policy and Terms of Service.

5. Subprocessors

We use a limited set of vendors, each contractually bound to protect the data and prohibited from selling it or using it for their own purposes:

• Vultr — cloud hosting and infrastructure.
• Stripe — payment processing (PCI-DSS Level 1). IntelX does not store full payment-card numbers, and Stripe webhook signatures are verified.
• OpenAI — AI processing for content generation and tutoring. Under its API terms, OpenAI does not use the data we send to train its models.

We keep this list current and update it when our subprocessors change.

6. Reliability & backups

• Backups: the production database is backed up automatically on a daily schedule.
• Resilience: automated container restart and health checks support continuity of service.

7. Incident response & breach notification

• If a security incident affects personal or student data, we notify affected users and Educational Partners without undue delay and as required by applicable law.
• We take reasonable steps to contain, investigate, and remediate incidents.
• A full security review and remediation cycle was completed in 2026, and security is reviewed on an ongoing basis.

8. What we're building next

We are transparent about our maturity as an early-stage company. On our security roadmap:

• Independent third-party penetration testing.
• Off-site, redundant encrypted backups.
• Multi-factor authentication for administrator and educator accounts.
• SOC 2 readiness as we scale.

9. Contact

For security questions, vendor questionnaires, or DPA requests, contact:

• IntelX LLC
• Email: security@intelx.app