School-aware access boundaries
SECURITY & TRUST
Security built around every school, role and action.
INTELLO EDU combines school-level data separation, role-aware access, mandatory MFA for privileged administrators, protected sessions and auditable security events—without adding unnecessary complexity to everyday school operations.
Mandatory MFA for privileged school administrators
Encrypted MFA secrets and hashed single-use recovery codes
Auditable authentication and security events
01
Identity protection at every privileged boundary
Password validation comes before MFA, and required administrators do not receive unrestricted administrative access until it is complete. MFA assurance is bound to the user, session and original host; privileged routes require recent assurance, while password confirmation protects sensitive actions.
- 01PasswordValidated before MFA.
- 02MFARequired for privileged administrators.
- 03Protected assuranceBound to user, session and host.
- 04Controlled recoveryHashed, single-use codes; throttled challenges.
02
Each school remains within its authorized boundary
The school is resolved from the host and verified as active; membership and role are then checked before destinations are available. Manipulated school, role and redirect contexts are rejected, while public portal role selection is a presentation hint only.
03
Role-aware access
Users receive only destinations and functions supported by their verified role and active school membership. Multiple legitimate roles use an authenticated selector.
04
Sensitive-data protection
- TLS protection in transit
- Application encryption for MFA secrets
- Hashed recovery codes and server-side validation
- CSRF, safe output rendering and session regeneration
- Host-bound pre-authentication and assurance contexts
05
Secure public interactions
- Scoped CSP and private, no-store previews
- CAPTCHA hostname, action, freshness, replay and score validation
- Session-bound, single-use fallback contexts
- Transactional enquiries, delivery ledger and idempotent duplicate protection
06
Auditability and accountability
The platform records login and MFA success/failure events with safe metadata—never passwords, TOTP values, recovery codes or secrets. Staff activity visibility follows authorization with time and role context.
INTELLO EDU
INTELLO EDU responsibilities
- Maintain application access controls
- Protect sensitive authentication material
- Enforce school-aware authorization boundaries
- Provide secure configuration and support guidance
YOUR SCHOOL
School responsibilities
- Assign administrator access carefully
- Update access when staff responsibilities change
- Protect devices, email accounts and recovery codes
- Report suspected account compromise promptly
FAQ
Security questions, answered
Which users must use MFA?
Privileged school administrators are required to use MFA. It is not claimed as mandatory for every user.
Can one school access another school’s data?
No. School context, active membership and role are verified before access.
What happens when a recovery code is used?
Recovery codes are hashed, stored individually and consumed atomically for one use.
How are repeated MFA failures handled?
MFA challenges are throttled and may result in a temporary lockout.
Does choosing a public portal role grant access?
No. It is a presentation hint only and never grants authority.
How are public forms protected?
They use CSP, CAPTCHA validation, server-side validation and duplicate protection.
How should a school report a suspected security issue?
Email edu@intello.ae with a safe description of the concern.
NEXT STEP
Privacy and transparency
Review our privacy information or talk with our team about your school’s security requirements.