Security and data protection
Safeguarding records are the most sensitive thing your school keeps. This page explains where they are stored, who can see them, how every view is recorded, and the documents your data protection officer (DPO) will ask for.
Stored in the UK, encrypted throughout
Every record, document and backup stays in UK data centres. AI runs inside Pupil Protect or on your school’s own server, never on an outside AI service.
- Where it is hosted
- UK data centres only, including backups. [Confirm hosting provider and regions]
- In transit
- Encrypted with TLS between every device and our servers. [Confirm minimum TLS version]
- At rest
- Encrypted with AES-256. Documents and attachments are encrypted individually, not just the disk they sit on.
- Backups
- Encrypted and kept in the UK. [Backup frequency and how long backups are kept]
- Testing and monitoring
- [Independent penetration testing: who and how often] [Monitoring arrangements, for example 24/7]
- Service status
- Planned maintenance and any outages are published on our status page.
Each person sees what their role needs, and no more
Your designated safeguarding lead (DSL) decides who can see what. Staff accounts come from your MIS, and each person is given a role. Every school starts with seven roles, which you can rename, change, add to or delete.
Each role has its own set of 46 permissions, in tabs for each product, so a role opens only the products and pages it needs. Every change to a role is logged.
- Which pupils
- For each role, all pupils, or only the forms, years or houses set for each person.
- Which categories
- For each role, the categories it can’t see and the categories it can’t log concerns in.
- Which alerts
- For each role, which new concerns alert it (all, urgent only, chosen categories or none), 6 other kinds of alert such as pattern alerts and unusual activity, and who can alert it by name from the concern form.
- How alerts arrive
- For each role, in Pupil Protect and by email, in Pupil Protect only, or one summary email at 07:00 on school days. Alert emails never include pupil details. Coming soon: text messages.
- Restricted records
- Mark sensitive categories as restricted, and only roles with “See restricted categories” can open them. Anyone else doesn’t see them at all, apart from the person who logged the concern. Coming soon: a log of refused attempts.
- Concerns about adults
- Kept in Pupil Protect Staff, separate from pupil records, and visible only to the people you choose.
- Hide names
- One click in the header turns pupils’ names into initials, for when a screen is being shared or someone is looking over your shoulder.
- Blank screen
- One click in the header hides everything straight away when someone walks in, until you enter your password.
- Signed out when idle
- After 15 minutes without activity by default. Your school chooses 5, 10, 15, 20, 30, 45 or 60 minutes. A warning shows 2 minutes before, and a concern being typed is saved as a draft.
- Two-step sign-in
- A code from an authenticator app, with 8 backup codes. Require it for everyone, or only for roles with more than everyday access. Staff who haven’t set it up are asked to at their next sign-in. Coming soon: single sign-on through Microsoft or Google, and limiting sign-in to the school network.
- Sign-in history
- Every sign-in and failed attempt, with the IP address and browser.
Every view of a record is logged
Views of records, changes, exports, prints, settings changes and MIS syncs are all recorded, with who and when. Sign-ins are recorded with the IP address and browser, and AI use has its own activity log. Filter the log by date, person, kind of action and pupil, and export it. Coming soon: saved searches.
Pupil Protect also flags activity worth a second look. Someone opening 20 or more pupil records in 10 minutes alerts your admins, and exports or prints between 20:00 and 06:00 are flagged.
- It can’t be edited or deleted
- Entries are never changed or deleted, not even by admins. Coming soon: each entry sealed to the one before it, so a missing or altered entry would show.
- Exporting the log is logged
- Each export of the log is recorded under the name of the person who did it.
- Who can see it
- Roles with “View the audit log”, by default the DSL and headteacher. Each person’s sign-in history is in Admin › Users.
- How long it is kept
- Entries are kept, and never changed or deleted.
Your school stays in control of its data
Under UK GDPR your school is the data controller. We are the processor, and we only act on your instructions, under a data processing agreement.
Data processing agreement
Our data processing agreement (DPA) sets out what we process, why, where, for how long, which sub-processors we use, and what happens to your data when you leave. It is ready to sign and comes in the document pack, alongside our security overview.
Version [DPA version],
- Data protection impact assessment
- We give you DPIA wording pre-filled for Pupil Protect: what data is processed, the risks and how they are reduced, including how the AI features use data. Your DPO reviews it and completes it for your school.
- Retention
Coming soon: you set it. By default, records will be kept until the pupil’s 25th birthday, then reviewed, and your DSL reminded 90 days before anything is deleted.
Coming soon: after a confirmed transfer to a new school, the record becomes read-only for your safeguarding team.
- Sub-processors
- A published list, with notice before any change. [Link to sub-processor list]
- Leaving us
- Export every record and document in a standard format at any time, at no extra cost. [What we delete, and when, after your contract ends]
Coming soon: subject access requests
Find and export everything held about a person, with the date of the request and the deadline to respond shown as you work.
Pupil Protect suggests what to redact, such as other pupils’ names and third-party details. You and your DPO decide each one, and the copy can’t be exported until your DPO has signed off the redactions. Every page is marked OFFICIAL-SENSITIVE and shows who exported it and when.
AI and your data
The AI features help staff write and help your DSL see patterns. They work under the same rules as everything else here, and a person approves everything they produce.
- Your data never trains AI modelsNot ours, not anyone else’s.
- A model your school controlsIt runs inside Pupil Protect or on your school’s own server, so pupil information never goes to an outside AI service.
- Ask can’t see recordsQuestions are answered from your policies and statutory guidance only.
- Every use is loggedThe AI activity log shows which feature, who, when, and whether the draft was used, edited or dismissed. It never keeps the text.
- Off until you switch it onThen you choose which roles can use it. Coming soon: a switch for each feature.
If something goes wrong
If we find or suspect a security incident affecting your school’s data, this is what we do.
To report a vulnerability or a suspected incident, see security reports on our contact page.
- 1Contain it
We stop the problem spreading, for example by closing access or revoking sessions. [Internal response target]
- 2Tell you
We tell your school’s named contacts without undue delay, and within [number] hours, so you can decide whether to report it to the ICO within 72 hours.
- 3Find out what happened
We use the audit log to show exactly which records and people were affected, and share what we find as we find it.
- 4Report and fix
You get a written report of the cause and what we have changed so it doesn’t happen again.
Accreditations and documents
Everything your DPO and IT lead need for their checks, in one pack.
- Accreditations
- None yet. We’re working towards [which certifications, for example Cyber Essentials and ISO 27001], and our security practices already follow [which guidance, for example NCSC guidance and the DfE’s cyber security standards for schools]. We’ll list certificate numbers here once we have them.
- Penetration test
- [Tester and date of last independent test]
- DfE standards
- [Which DfE digital and technology standards we meet, and evidence]
We’ll email to
You should get them within 2 working days. If they don’t arrive, check your junk folder or contact us.