The short version
The New Elearning is built on modern, boring infrastructure — hosted entirely in Europe, encrypted in transit, role-scoped by default, and auditable end-to-end. This page lists what's actually in place today. If you need something not listed here for procurement, email [email protected] and we'll answer honestly.
Hosted in the EU
All application servers, databases and backups run on Hetzner Cloud in Europe. Your data does not leave the EU.
Encryption in transit
Every request is served over TLS. Internal traffic between the app and its database runs on a private network.
Role-based access
Every user has one of three client roles — account admin, group admin, group user — and the app enforces access on every request. Group users never see data outside their own account.
Single sign-on (SSO)
Google and Microsoft SSO are available via OmniAuth for existing user accounts.
Immutable audit trail
Every meaningful action — course published, learner assigned, step completed, certificate issued or revoked — is logged and visible to admins. The log is append-only.
Verifiable certificates
Certificates carry a unique verification code and are publicly checkable by URL. Nothing to trust — anyone can verify a certificate exists and is valid.
Account isolation
Data is scoped per account and group at the query layer. Group admins only see their own group users, assignments and results.
Read-only API + API keys
The API is strictly read-only. Keys are stored as one-way digests (never in cleartext), can be rotated, and every use is logged.
Consent-controlled analytics
The website loads Umami Cloud analytics only after analytics consent. Rejecting analytics does not block the product, and consent can be changed from Cookie settings.
GDPR controls
The New Elearning includes consent-controlled analytics, privacy request intake, EU hosting, audit exports and a Data Processing Agreement (DPA) on request.
Being honest about what we don't have yet
We're a young product. A few things larger buyers routinely ask about are on the roadmap but not in place today. We'd rather tell you now than have you find out in a procurement review:
- SOC 2 Type II — planned, not yet audited.
- ISO 27001 — not pursued at current stage.
- SAML SSO + SCIM provisioning — on the Enterprise roadmap; Google and Microsoft OAuth SSO ship today.
- Bring-your-own-region hosting — Europe only for now.
- Independent penetration test — planned for after the first 10 paying customers.
If any of these is a hard requirement for you, tell us — we'd rather scope in a security programme with a design partner than surprise you six months in.
Questions? [email protected]
Back to home