1. Our approach
Schools trust us with students’ work and personal information. Our approach is simple: collect as little as possible, lock down what we hold, build on established infrastructure providers with strong security programmes, and be open about how we work.
2. Data minimisation
- We collect only what the platform needs to teach, mark and report progress (see our Privacy Notice).
- We do not ask for, and schools should not upload, special category data such as health or SEN information.
- AI marking receives only the text of an answer and a random reference number — never a name, email, school or class.
- We do not sell data, run advertising or use third-party analytics.
3. Hosting and infrastructure
The platform runs on established cloud providers (listed on our Sub-processors page) with mature, independently audited security programmes. We do not run our own servers.
4. Encryption
- In transit: all connections use HTTPS with modern TLS. Unencrypted connections are not accepted.
- At rest: databases, backups and file storage are encrypted by our hosting provider (AES-256).
- Secrets: API keys and service credentials are stored server-side as encrypted secrets and never sent to browsers or kept in source code.
5. Access control
- Role-based access, enforced in the database. Row-level security rules mean a student can read only their own work and a teacher only their own classes. These rules are enforced by the database itself, not only by the user interface.
- Content access. Licensed content and teacher materials are checked against each account’s access level on the server. Downloads come from private storage through short-lived signed links.
- Administrative access. Access to production systems and personal data is limited to a very small number of authorised people. Access uses strong, unique passwords and is used only for support, maintenance or security.
- User accounts. Passwords must be at least 10 characters and are stored only as salted hashes by our authentication provider. [CONFIRM: single sign-on with Google / Microsoft, once live]
6. Application security
- Every endpoint that touches personal data or AI marking requires authentication, and marking endpoints are rate-limited.
- AI spending is monitored with alerts and a kill switch, so a fault or misuse cannot run unchecked.
- Before releasing changes, we review access rules and endpoints for security issues. We periodically review the whole platform, including checking that no data is reachable without the right permissions.
- Third-party code libraries are kept up to date.
- Source code is held in a private repository.
7. AI safeguards
- AI marking runs only on our servers, through a business API account — never a personal subscription.
- Our AI provider is contractually prohibited from training its models on our data and deletes request data within a limited period.
- Teachers can review and override every AI mark, and low-confidence marks are flagged for review.
- See our AI Statement for more.
8. Backups and continuity
The database is backed up automatically by our hosting provider [CONFIRM: daily, with N days’ retention / point-in-time recovery]. Source code is version-controlled and can be redeployed. Students’ work is saved as they go.
9. Incident response
We have a written incident response plan. If we become aware of a personal data breach affecting a school’s data, we will:
- contain it and assess the risk;
- notify the school in writing within 48 hours, with what we know;
- help the school notify its regulator and affected people where required; and
- investigate the cause, fix it, and tell the school what we changed.
Where we are the controller (for example, individual subscribers), we will notify the relevant regulator within 72 hours where the law requires and tell affected people without undue delay where there is a high risk to them.
10. Reporting a security issue
If you think you have found a security weakness, please email security@secondnaturelearning.com with enough detail for us to reproduce it. Please do not access other people’s data, run automated scans, or disrupt the service. We will acknowledge your report within three working days and keep you informed.
11. Questions from schools
We are happy to complete security and privacy questionnaires as part of procurement. Email privacy@secondnaturelearning.com.
Questions about this document? Email legal@secondnaturelearning.com. Back to the Legal hub