The short version
The Next Elearning is built on modern, boring infrastructure — hosted entirely in Germany, encrypted in transit, role-scoped by default, and auditable end-to-end. This page lists what's actually in place today. If you need something not listed here for procurement, email [email protected] and we'll answer honestly.
Hosted in the EU
All application servers, databases and backups run on Hetzner Cloud in Germany. Your data does not leave the EU.
Encryption in transit
Every request is served over TLS. Internal traffic between the app and its database runs on a private network.
Role-based access
Every user has one of three roles — creator, account admin, learner — and the app enforces access on every request. Learners never see data outside their own account.
Single sign-on (SSO)
Google Workspace SSO is available today via OmniAuth. SAML/OIDC and SCIM provisioning are on the Enterprise roadmap.
Immutable audit trail
Every meaningful action — course published, learner assigned, step completed, certificate issued or revoked — is logged and visible to admins. The log is append-only.
Verifiable certificates
Certificates carry a unique verification code and are publicly checkable by URL. Nothing to trust — anyone can verify a certificate exists and is valid.
Account isolation
Data is scoped per account at the query layer. An account admin only ever sees their own learners, assignments and results, even through the API.
Read-only API + API keys
The API is strictly read-only. Keys are stored as one-way digests (never in cleartext), can be rotated, and every use is logged.
No third-party trackers
The public marketing site uses privacy-friendly analytics (Plausible) with no cookies. The application itself uses no third-party trackers.
GDPR-compliant by design
The Next Elearning is built and hosted for GDPR compliance. A Data Processing Agreement (DPA) is available on request.
Being honest about what we don't have yet
We're a young product. A few things larger buyers routinely ask about are on the roadmap but not in place today. We'd rather tell you now than have you find out in a procurement review:
- SOC 2 Type II — planned, not yet audited.
- ISO 27001 — not pursued at current stage.
- SAML SSO + SCIM provisioning — on the Enterprise roadmap; Google SSO ships today.
- Bring-your-own-region hosting — Germany only for now.
- Independent penetration test — planned for after the first 10 paying customers.
If any of these is a hard requirement for you, tell us — we'd rather scope in a security programme with a design partner than surprise you six months in.
Questions? [email protected]
Back to home