No badges that mean nothing. Where each product keeps its data, who touches it, the controls we actually run, what we are certified for and what we are not yet. Verified against our live infrastructure on 23 September 2026 and kept current with every release.
Every dashboard is local-first: it runs in your browser and, unless you turn on hosted team mode, nothing leaves your device. Where hosting is offered or built in, this is exactly where it is.
| Product | Default | Hosted team mode | Where hosted data lives |
|---|---|---|---|
| TradeIQ, InvoiceIQ, HRIQ, AssetIQ, AssureIQ, CareIQ, InspectIQ, SecureIQ, WasteIQ | Local — in your browser, on your device | Optional | Supabase on AWS London (eu-west-2), shared suite database, each team separated by row-level security |
| iPhone & Android apps for the products above | Offline-first on the phone | Syncs to the same team space | London (eu-west-2) |
| DiaryIQ, ToolboxIQ | Hosted for the team | Built in | Supabase on AWS London (eu-west-2), shared suite database, each organisation separated by row-level security. Every product is multi-tenant: a new customer is a new team, never a separate database |
| FinanceIQ | Local only | Not offered today | Nothing hosted by us |
| InspectIQ public certificate register (the QR verify page) | n/a | n/a | London (eu-west-2). Holds published certificate metadata only — never photos, notes or the full record |
| This website, product landing pages and demos | Static pages | n/a | Cloudflare Pages (global delivery network). No customer data is stored; demos run on sample data in your browser |
For anything you host with us you are the controller and Intelligent Dashboards Ltd is the processor, under a UK GDPR Article 28 Data Processing Agreement signed with every hosted plan. In local mode we process nothing at all.
Supabase — database, authentication and file storage for hosted mode, AWS London. Cloudflare — delivery of the website and apps; cookieless analytics on this site. Resend — the reminder and notification emails the apps send, the email that passes a Dash chat to our support team, and our internal weekly round-up of ideas people send us, which goes only to our own support mailbox and founder (US; covered by its DPA). Anthropic — only Dash, our chat assistant, which receives what you type to it and your company name and never your stored records, the optional “Draft with AI” button, which receives the short topic you type and never your stored records, ToolboxIQ’s opt-in AI safety insights, which receives counts and short de-identified excerpts, and hosted ESDH’s PDF bill reading, which receives the bill you upload and stores nothing (US; covered by its DPA). Apple and Google — distribution of the native apps through their stores. That is the whole list; we give hosted customers 30 days’ notice before adding to it.
One person: the founder who built the product. Access to hosted data is by named account with multi-factor authentication, used only to run the service for you or at your request — never for analytics, marketing or training anything.
Anomaly flagging runs inside your dashboard. The only AI provider we use is Anthropic, for four optional features. The “Draft with AI” button in ToolboxIQ, AssureIQ and HRIQ writes a first draft for you to edit; only the short topic, hazard or job title you type is sent, never your stored records. ToolboxIQ’s AI safety insights, which each organisation switches on, calculates every figure itself and sends Anthropic only counts and short incident excerpts with names, emails and phone numbers removed, so it can explain trends in plain English. In the hosted ESDH app, you can have a supplier PDF bill read into its fields; our server checks the figures, you confirm them before import, and the PDF isn’t stored. Dash, the chat assistant in IQ Hub and the apps, answers how-to questions from our manuals (on this website, Dash answers visitors’ typed questions from the text of our public pages, with only what the visitor types sent to Anthropic); it receives only what you type to it and your company name, can’t see or change your data, and hands your chat to our support team (with a short summary) only if you ask for a person. None of these is used to train models, figures in reports always come from our own calculations, and Anthropic is listed as a sub-processor in your DPA.
TLS in transit everywhere. Hosted data is encrypted at rest by the database platform. In local mode your data is as protected as your device — we recommend disk encryption and a device passcode, which the native apps require.
Multi-factor authentication on every admin and supplier account we hold. In hosted mode, permissions are enforced by row-level security in the database itself, not just hidden in the app, so a team can only ever read its own rows.
Hosted mode writes an append-only audit log — entries can be added and read, not edited or deleted. InspectIQ additionally numbers every certificate immutably and publishes only metadata to its public verify register.
Export everything as JSON or CSV at any time, in any mode. On exit you receive a final full export and keep a working single-file copy of the app, so you can still read your data with no vendor involved.
Held: Cyber Essentials (basic level, verified self-assessment) — certificate issued by IASME, assessed by Pera Prometheus, issued 5 October 2026, valid until 5 October 2027, with IASME cyber liability insurance included. It certifies Intelligent Dashboards Ltd's own company IT, not the software products themselves. Also held: ICO data-protection registration ZC255636, verifiable on the ICO register. Not held: Cyber Essentials Plus, ISO 27001 (our programme is under way; we are not certified) and the NHS Data Security and Protection Toolkit (next on the roadmap). If it is not named here, we do not hold it.
We are a single-founder business and say so in the contract. The mitigants are structural: you can export all your data at any time in open formats, the app runs without us, and a source-code and data escrow option is available with release triggers for founder incapacity or the business ceasing to trade.
Email support@intelligentdashboards.co.uk and we will return a completed security questionnaire, the DPA and the exit schedule — before a call, not after it.