Security
EduComply is designed to meet the security and data protection expectations of UK schools and multi-academy trusts.
Security or procurement questions? We're happy to help.
At a glance
Encryption
Data is encrypted in transit and at rest. Connections to EduComply are secured using TLS.
Access control
Only authorised, signed-in users within your trust can access trust data. There is no public access to customer information.
Data isolation
Each trust's data is stored separately. No cross-trust access is possible. Users only see data within their own trust.
Audit trail
Uploads, changes, and reviews are recorded to support inspection readiness and operational history.
UK hosting
Customer data is hosted in UK-based infrastructure by default. Data is not transferred outside the UK or EEA.
Backups and recovery
Customer data is backed up regularly to help protect against accidental loss or service disruption.
Data residency
EduComply stores customer data in UK-based cloud infrastructure by default. Data is not transferred outside the UK or EEA.
Customer evidence, compliance records, and related operational data remain within your trust's workspace. If you have specific data residency requirements, we are happy to discuss them.
Infrastructure and service protection
- •EduComply runs on secure, managed cloud infrastructure with standard cloud security controls applied.
- •Access to production systems is restricted and monitored.
- •Systems are maintained with regular updates and operational monitoring.
- •Backup processes are in place to support recovery from accidental data loss or service disruption.
How we handle your data
- •Evidence is treated as the source of truth. Uploaded or emailed documents are stored as evidence records within your trust workspace.
- •Extracted inspection metadata - such as dates, areas, and compliance details - is used to support and maintain your compliance records.
- •Customers retain ownership of their data. EduComply processes data on your behalf to deliver the service.
- •Retention and deletion are handled in line with your contract and UK data protection expectations.
Email and attachments
- Documents sent to EduComply by email are securely received and stored inside your trust workspace.
- Attachments are treated as evidence records and linked to the relevant school and compliance area.
- Access to emailed documents is limited to authorised users within your trust.
- If a document is associated with the wrong school or record, it can be corrected. Changes are tracked in the audit history.
Automated document analysis
Uploaded or emailed documents may be automatically analysed to extract structured information such as inspection dates, expiry dates, areas covered, and compliance details.
This processing supports compliance record management and helps reduce manual data entry. It is not used to create legal obligations or to override customer judgement.
The original source document remains linked as evidence. Where extracted information needs correction, authorised users can update records and the change is tracked.
Access and permissions
- Only authenticated, signed-in users can access EduComply. There is no public access to trust data.
- Users only see data permitted for their role. Access is controlled by role-based permissions.
- Your trust's data is stored separately from other trusts. No cross-trust access is possible.
- Within your trust, access can be tailored so that staff see only the schools and records relevant to their responsibilities.
Our data protection commitments
- We do not sell customer data.
- We do not share customer documents with other trusts.
- We do not make trust evidence publicly accessible.
- We do not use customer documents for unrelated purposes.
Backups and recovery
Customer data is backed up regularly as part of standard operational practice. Backup data is protected and stored securely.
Backups support recovery from accidental data loss or service disruption, helping to ensure that your compliance records and evidence remain available.
Frequently asked questions
In summary: EduComply is UK-hosted, access-controlled, audit-tracked, and designed to keep trust data separate and inspection-ready.
Security or data handling questions?
We're happy to help with security, data handling, DPIA, or procurement queries. If you need supporting documentation as part of a procurement process, please get in touch.
Our privacy policy and terms of service are available for review. You can also read about EduComply and the company behind it.
security@educomply.co.uk