Security and trust
An honest position, stated plainly
Education buyers are asked to trust a great deal. The least a supplier can do is be precise about what is designed, what is planned and what is not claimed.
Security design principles
- Role-based access control, scoped by school and by partner client.
- Least-privilege defaults, including for administrators.
- Separation of editing rights from approval rights.
- Full audit history on every record change.
- Encryption in transit and at rest.
- UK/EU data residency intent for production deployments.
- Configurable data retention periods.
- No requirement to hold pupil records.
- Export of your own data on request.
These describe the platform's design intent. Independent assurance activity would be confirmed as the product matures.
AI governance controls
- AI outputs are labelled, dated and attributed to their sources.
- A named human reviewer is required before an AI draft is used.
- AI cannot access information the requesting user is not permitted to see.
- AI cannot approve, publish, purchase or communicate externally.
- An organisation-level register records which AI features are enabled.
- AI features can be turned off at organisation or school level.
AI assists with preparation and analysis. Accountable decisions remain with named people.
What we do not claim
Deliberately explicit
- We do not claim any current certification or accreditation, including Cyber Essentials, ISO 27001 or DfE approval.
- We do not claim endorsement or approval by the Department for Education.
- We do not guarantee legal, regulatory, safeguarding or GDPR compliance.
- We do not claim the platform is currently in use by real schools.
- We do not claim any third-party integration is live today.
- We do not present the platform as a substitute for professional advice.
Data protection posture
The platform is designed to hold operational and staff-role information, not pupil records. Data-processing responsibilities would be set out in a written agreement.
Demonstration data
Every school, person, document and statistic in the demonstration is fictional. No real pupil data or safeguarding case information is used anywhere on this site.
Questions welcome
If a security or data-protection question is not answered here, ask. An honest “not yet” is a valid answer.
Have a security or data protection question?
Send it through and we will answer specifically, including where the answer is that something does not exist yet.