Trust Center

Last updated: October 29, 2026

Summary of the frameworks, security controls, and compliance status that apply to Intelloro.

Privacy

Multi-jurisdiction policy stack: GDPR + UK GDPR + PIPEDA + Quebec Law 25 + LGPD + PDPO. Intelloro is not directed at children; our Terms set a minimum age, accepted at sign-up.

Platform Regulation

EU Digital Services Act (Art. 16 notice form + Art. 17/20 decision process; trader rules do not apply as nothing is sold on Intelloro), EU AI Act (limited-risk classification + Art. 4 + 50 disclosure), DMCA (registered agent), CAN-SPAM (unsubscribe in every marketing email).

Security

TLS encryption in transit (Vercel) + encryption at rest (MongoDB Atlas) + restricted admin access. SOC 2 and ISO 27001 are not pursued.

Compliance Matrix

Framework	Region	Status	Implementation
GDPR (Regulation 2016/679)	EU/EEA	Partial	Lawful basis mapped, DSAR API; transfers rely on our subprocessors' EU–US Data Privacy Framework certification (where certified) or SCCs
UK GDPR + DPA 2018	United Kingdom	Partial	Same as GDPR, ICO complaints supported
Quebec Law 25	Canada (Quebec)	Partial	Privacy Officer named + automated-decision rights documented
Federal PIPEDA	Canada	Self-Declared	OPC complaints supported
LGPD (Law 13.709/2018)	Brazil	Self-Declared	DPO contact, ANPD complaint path
ECA Digital (Law 15.211/2025)	Brazil (minors)	Self-Declared	Not directed at children; Terms set a minimum age of 13 (16 where local law requires), accepted at sign-up
Bangladesh PDPO 2025	Bangladesh	Self-Declared	DPO appointed, lawful basis
COPPA (15 USC §§ 6501-6506)	USA (children)	Self-Declared	No knowing collection from under-13
GDPR Art. 8 (children)	EU/EEA	Self-Declared	Not directed at children; Terms set a minimum age of 13 (16 where local law requires), accepted at sign-up
UK Children's Code	United Kingdom	Self-Declared	Not directed at children; Terms set a minimum age of 13, accepted at sign-up
California AADC	California, USA	Self-Declared	Not directed at children; Terms set a minimum age of 13, accepted at sign-up
EU Digital Services Act (DSA)	EU/EEA	Partial	Art. 16 notice form, Art. 17/20 decision process documented; trader rules (Art. 29-32) do not apply — no purchases on Intelloro
EU AI Act (Reg. 2024/1689)	EU/EEA	Partial	Limited-risk self-classification, Art. 50 disclosure on /ai-disclosure, AI-generated text labelled on every tool and agent detail page, public methodology
DMCA	USA	Compliant	Designated agent registered with the U.S. Copyright Office (DMCA-1083365); takedown + counter-notice
CAN-SPAM Act	USA	Self-Declared	Single-click unsubscribe in every marketing email
ePrivacy Directive (cookies)	EU/EEA	Self-Declared	Granular consent banner, GPC honored
WCAG 2.1 Level AA	Global	In Progress	Self-evaluation, see Accessibility Statement
European Accessibility Act	EU/EEA	Not Applicable	No online sales; microenterprise service exemption. We follow WCAG 2.1 AA anyway
TLS encryption (in transit)	Global	Compliant	Provided by Vercel edge
Encryption at rest	Global	Compliant	Provided by MongoDB Atlas
SOC 2 Type II	USA / Global	Not Pursued	No audit or certification started
ISO 27001	Global	Not Pursued	No audit or certification started

Status Legend

Compliant — Framework is fully implemented and documented; user-facing rights are active.
In Progress — Work has started but is not complete.
Self-Declared — Our own check of the points listed in the row; no external audit.
Partial — Some parts in place; not complete.
Not Applicable — Framework does not apply to Intelloro's current operations.
Not Pursued — We have not started this certification.

These statuses reflect Intelloro's own self-assessment, not a government certification. Data-protection regulations such as GDPR, CCPA, LGPD and PDPO have no official certification scheme — a “Self-Declared” row is our own check of the points listed in that row — not a claim of full compliance — and no independent third-party audit has been done. Rows naming a specific external certification (SOC 2, ISO 27001) show their true audit status, and encryption rows describe a factual technical control provided by our infrastructure vendors.