Security & data protection
Security you can verify, not simply take on trust
Student Radar handles attendance, behaviour, SEND and safeguarding records: some of the most sensitive data a school holds. The controls behind that work should stand up to practical scrutiny.
Every material claim below links to the document behind it. Hosting, certification, AI, retention and contractual boundaries are stated at the level the published evidence supports.
Controls you can inspect
Hosting, encryption, access and retention claims sit beside the published source document that supports them.
Boundaries made explicit
The page separates primary hosting from other processing, base certification from higher levels, and agreement templates from signed agreements.
People stay accountable
Your school remains the controller, optional AI stays school-controlled, and professional judgement remains the decision point.
Published control evidence
Six controls, each linked to its evidence
Security language is useful only when a buyer can trace it back to a current document. These are the control statements procurement teams most often need first.
Cyber Essentials is the base certification. The page does not claim Cyber Essentials Plus or ISO 27001.
UK-hosted primary database
The primary pupil database is configured in Supabase’s eu-west-2 London project. Application hosting and optional or user-triggered services have separate processing boundaries documented below.
Source document: Sub-Processor ListEncrypted at rest and in transit
The primary data platform uses AES-256 encryption at rest, and current published controls require TLS 1.2 or higher for data in transit.
Source document: Information Security PolicyStrict access control
Multi-factor authentication is mandatory for every staff account. Role-based permissions and database-level controls mean each person sees only the pupils and records their role requires.
Source document: Information Security PolicyCyber Essentials certified
Certified under the UK government-backed Cyber Essentials scheme, which covers the core technical controls that stop the most common attacks. This is the base certification, not Cyber Essentials Plus or ISO 27001.
Source document: Cyber EssentialsYou control retention
Your school sets its record-retention schedule. The DPA requires return or deletion of live school data within 30 days of termination, a 30-day rolling backup cycle and final expiry of residual backups by day 60, subject to limited retention required by law.
Source document: Data Retention PolicyYou remain the data controller
Your school or trust stays the data controller. SENDlink Ltd, trading as Student Radar, acts as your processor. The published DPA is an agreement template with signature fields, used with the MSA and your customer-specific Order Form.
Source document: Data Processing Agreement
AI features inside the platform are optional and switched on by your school. Before any text reaches an AI model, our own Inkwell engine finds personal details and replaces them with tokens, and it does that in the browser: the identifying text never leaves the device. Deterministic UK identifier rules always run, and an on-device model adds context for the awkward cases. Staff see what has been replaced and confirm it before anything is sent.
We do not treat that as a reason to stop checking. Automated detection is never the last word on a safeguarding record, so recommendations stay advisory and a member of staff decides. Student Radar makes no automated pupil decisions under Article 22 of the UK GDPR, and nothing your school sends is used to train AI models.
Our free public tools, Echo and the Sensory Profiler, run separately and only when a visitor asks them to. They never receive a pupil’s name, school, year group or SEND status: the Sensory Profiler sends only the generic pattern selections the visitor ticked, and rejects free text outright. Nothing sent to them is used to train AI models, and our AI provider deletes its own abuse-monitoring copy within 30 days. Our Privacy Policy sets out exactly what each tool sends and how long anything is held.
Processing and recovery
Know where the boundaries sit and what happens next
Primary database location is only one part of the picture. Buyers also need the supplier boundary, optional services, backup window and incident response position in plain language.
Sub-processors
The customer pack lists Supabase, Vercel, Wonde, Brevo, OpenAI and AssemblyAI, with Twilio, Sentry and Contentsquare where used. The DPA and Sub-Processor List set out their purposes, information, processing locations and safeguards. Primary UK storage does not mean every provider processes information only in the UK.
Retention and resilience
The DPA requires a 30-day rolling backup cycle, live-data return or deletion within 30 days of termination and final backup expiry by day 60. Personal-data breaches must be reported to the school without undue delay and within 24 hours of awareness, with available facts followed by updates.
Documentation for procurement
Give your reviewers the evidence, not another promise
Your procurement team can download everything they normally ask for, including our Sub-Processor List, AI Transfer Overview, Business Continuity Summary, Incident Response Policy and Cyber Essentials certificate. If something they need is not there, ask us and we will tell you where it stands.