Your data
Where your school's data is kept, who can see it, how long it stays, and a data processing agreement you can file.
Where it lives
In Microsoft Azure's UK South region: the application, the database and uploaded documents all sit there, and nothing is transferred outside the United Kingdom. Data is encrypted in transit and at rest. Automated daily backups are kept by Azure for at least seven days.
Who can see it
Your school's data is isolated at the database level, so one school can never see another's. Within your school, only the people you invite can sign in, with the role you give them. On our side, access to production systems is limited to named SchoolProof staff with multi-factor authentication, and every meaningful action in the platform is written to an audit trail you can read from your own activity log.
What we collect, and don't
Names, work email addresses and roles of the people you invite; the answers you give in the audit; the documents you upload; who acknowledged, reviewed or exercised a procedure; and, if you switch visitor sign-in on, visitors' and staff sign-in times. We set no tracking cookies and use no third-party analytics: our own visitor counts use a daily-rotating hash that cannot identify anyone. We never sell data or use it for advertising.
How long it stays
| Free readiness check, no account | Deleted 24 months after last activity |
| Visitor sign-in records | Deleted after the period you set (12 months by default) |
| Staff sign-in records | Deleted after 31 days |
| Audit, procedures, sign-offs, drills, evidence | Kept for the life of your account |
| After your account ends | Export anything first; deleted within 30 days, or sooner on request |
Who else is involved
Two sub-processors, both Microsoft: Azure for hosting, database, storage and monitoring (UK South), and Azure Communication Services for the emails the platform sends. Nobody else receives personal data. If that list ever changes we will say so here at least 30 days beforehand.
If something goes wrong
We tell you without undue delay, and in any case within 24 hours of becoming aware of a breach affecting your data, with what you need for your own 72-hour notification to the ICO, and we help contain it.
The agreement
Our data processing agreement sets all of this out in the shape UK GDPR Article 28 requires: you as controller, Alacria Limited as processor. It applies automatically from the moment you create an account, so there is nothing to sign, but a signed copy is available on request.
Download the data processing agreement (PDF)
Related: privacy notice · terms of service · paying for SchoolProof. Supplier questionnaires and anything else: hello@schoolproof.co.uk.