Trust & Security

Security your whole school can rely on.

You are trusting us with sensitive records — including children’s data. We treat that responsibility as foundational, not a feature. Here is how we protect it.

How we protect your data

Defence in depth, at every layer

Encryption everywhere

Data is encrypted in transit with TLS and at rest in our databases and file storage, so it is protected on the wire and on disk.

Role-based access control

Granular RBAC lets each school decide exactly who sees what. Users only ever reach the data their role permits — nothing more.

Isolated infrastructure

The platform runs on hardened, reputable cloud infrastructure with network isolation and tightly scoped internal access.

Backups & resilience

Automated, regularly-tested backups and a documented recovery process keep your data safe from loss and help us recover quickly.

Monitoring & logging

We log and monitor activity across the platform to detect and respond to anomalies, abuse and unauthorised access attempts.

Least-privilege access

Internal access follows the principle of least privilege, is scoped to what a task requires, and is reviewed and revoked as roles change.

How we build

Security and privacy as a practice

Secure by design

Security is built into how we work — code review, dependency scanning, and secure defaults across the stack. Sensitive credentials such as passwords are stored only as strong one-way hashes.

Privacy by design

We collect the minimum data needed, keep children’s data strictly within the school’s control, and never sell personal information. See our Privacy Policy and Data Processing terms.

Vendor management

Every sub-processor is vetted and bound by data-protection obligations. Our current sub-processor register is public and kept up to date.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email us with details and steps to reproduce, and give us a reasonable opportunity to investigate and remediate before any public disclosure. We will not pursue action against good-faith research that respects our users’ privacy and data.

Run your whole school on one connected platform

Start with the base package, switch on the modules you need, and give every parent, student and staff member a single place to log in.