Security and data protection
Safeguarding records are the most sensitive thing your school keeps. This page explains where they are stored, who can see them, how every view is recorded, and the documents your data protection officer (DPO) will ask for.
Stored in the UK, encrypted throughout
Every record, document and backup stays in UK data centres, including the data our AI features work with.
- Where it is hosted
- UK data centres only, including backups and AI processing. [Confirm hosting provider and regions]
- In transit
- Encrypted with TLS between every device and our servers. [Confirm minimum TLS version]
- At rest
- Encrypted with AES-256. Documents and attachments are encrypted individually, not just the disk they sit on.
- Backups
- Encrypted and kept in the UK. [Backup frequency and how long backups are kept]
- Testing and monitoring
- [Independent penetration testing: who and how often] [Monitoring arrangements, for example 24/7]
- Service status
- Planned maintenance and any outages are published on our status page.
Each person sees what their role needs, and no more
Your designated safeguarding lead (DSL) decides who can see what. Staff accounts are imported from your MIS, and each person is given one of four access levels.
- Restricted records
- Mark sensitive categories as restricted and only the safeguarding team can open them. If anyone else tries, they are told they don’t have access, nothing about the record is shown, and the attempt is logged.
- Concerns about adults
- Kept in Pupil Protect Staff, separate from pupil records, and visible only to the people you choose.
- Hide names
- One click in the header turns pupils’ names into initials, for when a screen is being shared or someone is looking over your shoulder.
- Blank screen
- Clears the screen straight away when someone walks in. It also happens on its own after a period of inactivity, 15 minutes by default.
- Two-step sign-in
- Can be required for everyone, with single sign-on through Microsoft or Google. Staff who haven’t set it up are asked to at their next sign-in.
- Session timeout
- Staff are signed out after a period of inactivity, 60 minutes by default. You can limit sign-in from outside the school network to the safeguarding team.
Every view of a record is logged
Views, changes, exports, prints, permission changes, sign-ins and AI use are all recorded, with who, when and from which device. Your DSL can search the log, save searches and export it.
Pupil Protect also flags activity worth a second look: bursts of record views, exports at odd hours and sign-ins from new devices. Your DSL reviews each flag and the decision is logged.
- It can’t be edited or deleted
- Not by you, other admins or Pupil Protect staff. Each entry is sealed to the one before it, so a missing or altered entry would show.
- Looking at the log is logged
- Searches, entries opened and exports from the log are recorded under the name of the person who did them.
- Who can see it
- Full access users only. Staff can see their own sign-in history in their account.
- How long it is kept
- [Audit log retention period]. Safeguarding records themselves follow your own retention settings.
Your school stays in control of its data
Under UK GDPR your school is the data controller. We are the processor, and we only act on your instructions, under a data processing agreement.
Data processing agreement
Our data processing agreement (DPA) sets out what we process, why, where, for how long, which sub-processors we use, and what happens to your data when you leave. It is ready to sign and comes in the document pack, alongside our security overview.
Version [DPA version],
- Data protection impact assessment
- We give you DPIA wording pre-filled for Pupil Protect: what data is processed, the risks and how they are reduced, including how the AI features use data. Your DPO reviews it and completes it for your school.
- Retention
You set it. By default, records are kept until the pupil’s 25th birthday, then reviewed, and your DSL is reminded 90 days before anything is deleted.
After a confirmed transfer to a new school, the record becomes read-only for your safeguarding team.
- Sub-processors
- A published list, with notice before any change. [Link to sub-processor list]
- Leaving us
- Export every record and document in a standard format at any time, at no extra cost. [What we delete, and when, after your contract ends]
Subject access requests
Find and export everything held about a person, with the date of the request and the deadline to respond shown as you work.
Pupil Protect suggests what to redact, such as other pupils’ names and third-party details. You and your DPO decide each one, and the copy can’t be exported until your DPO has signed off the redactions. Every page is marked OFFICIAL-SENSITIVE and shows who exported it and when.
AI and your data
The AI features help staff write and help your DSL see patterns. They work under the same rules as everything else here, and a person approves everything they produce.
- Your data never trains AI modelsNot ours, not anyone else’s.
- Processed in the UKGPT-6 through Microsoft’s Azure OpenAI Service, hosted in a UK region. [Contractual safeguards]
- Ask can’t see recordsQuestions are answered from your policies and statutory guidance only.
- Every use is loggedThe AI activity log shows each suggestion, who used it and what they kept.
- Every feature can be switched offBy your school, at any time, in Admin.
If something goes wrong
If we find or suspect a security incident affecting your school’s data, this is what we do.
To report a vulnerability or a suspected incident, see security reports on our contact page.
- 1Contain it
We stop the problem spreading, for example by closing access or revoking sessions. [Internal response target]
- 2Tell you
We tell your school’s named contacts without undue delay, and within [number] hours, so you can decide whether to report it to the ICO within 72 hours.
- 3Find out what happened
We use the audit log to show exactly which records and people were affected, and share what we find as we find it.
- 4Report and fix
You get a written report of the cause and what we have changed so it doesn’t happen again.
Accreditations and documents
Everything your DPO and IT lead need for their checks, in one pack.
- Accreditations
- None yet. We’re working towards [which certifications, for example Cyber Essentials and ISO 27001], and our security practices already follow [which guidance, for example NCSC guidance and the DfE’s cyber security standards for schools]. We’ll list certificate numbers here once we have them.
- Penetration test
- [Tester and date of last independent test]
- DfE standards
- [Which DfE digital and technology standards we meet, and evidence]
We’ll email to
You should get them within 2 working days. If they don’t arrive, check your junk folder or contact us.