EdTechLab
EN

Security & trust

How we handle data, AI, accessibility and hosting.

The answers digital, procurement and data-protection teams usually need, across the platforms we build for institutions and the platforms we run ourselves.

Institutional work

You are the controller. We are your processor.

When we build and run a platform for an institution, the institution decides how personal data is used and EdTechLab processes it on its behalf, with the roles set out in the project agreement. For WorkReady Finance, UWE Bristol is the data controller and EdTechLab the data processor, and the platform's privacy notice says so.

Our platforms

Account data stays with us; learner data can stay with you.

For intle, EngagedLab and interacty, EdTechLab is responsible for account data. Content exported as SCORM runs inside your own LMS: intle's packages send no learner data back, and EngagedLab's packages only return evidence if you opt in.

Hosting and data location

Where each platform runs.

Hosting, data location and database controls for each platform.
Platform Hosting and data location Data controls
WorkReady Finance Web app on Vercel; Postgres database in London (UK) Row-level security on every table; anonymous learners; consent and erasure flows
intle EdTechLab-operated servers in Germany (EU) Row-level security; published sub-processor register; retention by plan; self-service account deletion
EngagedLab An isolated, containerised stack with its own dedicated database Row-level security with a restricted application role; encrypted daily backups
interacty EU hosting (Ireland) Private storage; revocable hosted links; no advertising trackers

Privacy by design

Collect less, protect small groups, keep people anonymous where we can.

  • WorkReady Finance learners never create an account; an optional PIN lets them resume.
  • intle supports anonymous participation in hosted sessions.
  • EngagedLab hashes LMS learner identifiers and keeps free text out of analytics.
  • Cohort figures are hidden below five learners in EngagedLab evidence reports.
  • No advertising trackers on our platforms or this website.

Responsible AI

AI where it helps, with people in charge.

AI features are optional or reviewed, and designed so that nothing reaches learners without a human decision somewhere in the loop.

  • Human review

    intle's educators approve a plan before generation; interacty's AI only proposes edits that a person approves.

  • Defences against manipulation

    Uploaded material is treated as untrusted, with defences against hidden instructions and guarded web fetching.

  • Tutors that teach

    EngagedLab's tutor is grounded in the current step and designed to withhold answers during an attempt.

  • Known models, checked output

    Allow-listed models, strict output schemas and automated quality gates on what is generated.

Security engineering

Defence in depth, tested continuously.

  • Row-level security at the database layer, with secrets held server-side
  • Token authentication, schema validation and rate limiting on APIs
  • Upload safeguards, including protection against malicious archives
  • More than 12,000 automated tests across our four live platforms

Accessibility

WCAG 2.2 AA is our engineering target.

  • Automated accessibility testing in our test suites
  • Keyboard alternatives to drag and drop, and reduced-motion support
  • Read-aloud, dyslexia-friendly and high-contrast options in WorkReady Finance
  • Text equivalents for interactive and 3D content
Read our accessibility statement

Assurance and incidents

What procurement teams usually ask.

Certifications
We hold no formal security certifications today. Cyber Essentials readiness work is under way, and we will list certifications here once they are awarded.
Data processing agreements
Our processor role is set out in each project's agreement. intle publishes its data processing terms.
If something goes wrong
We confirm the scope, contain the exposure, rotate affected credentials or access, and notify the controller without undue delay so notification duties under UK GDPR can be met.
Reporting a concern
Email hello@edtechlab.co.uk with "Security" in the subject line.

This website

edtechlab.co.uk is a static site with one server-side form.

There are no user accounts or payments here. Traffic is served over HTTPS with security headers, enquiries go to a server-side endpoint with spam checks, and there are no advertising cookies or third-party profiling.

Providers used by the edtechlab.co.uk website.
Provider What it does Data involved
Vercel Hosting, the contact endpoint, and aggregate analytics and performance data on our domains Request metadata, IP address, performance data, contact-form metadata
Resend Delivers enquiry notifications to our inbox Sender and recipient details, message content, delivery metadata
Cloudflare Turnstile Checks that contact-form submissions come from a person rather than an automated script IP address and technical browser signals, used for that check
Privacy policy Accessibility statement Contact us