Built around UK GDPR from the start
Your data lives in the UK. One school's content is kept apart from another's at the deepest level. Personal information is encrypted. Backups happen every day, encrypted again, kept for thirty days. And every document a data protection officer needs to do their assessment is already on the website — no sales call, no NDA.
The capability, in plain English
Schools are kept separate at the deepest level
Your school's content is kept apart from every other school's at the database itself, not just by application code. Even an unlikely software bug couldn't show another school your data.
Personal information is encrypted
Names, emails, phone numbers, addresses and chat content are all encrypted before they're stored. Even someone with direct access to the database would see nothing useful.
Admin tools are locked down
The super-admin panel can only be reached from approved office addresses, and even then it requires two-factor sign-in. Off that list, the panel doesn't exist.
Daily encrypted backups, UK-hosted
Every night your school's data is backed up, encrypted again, and stored in our London region. We keep backups for thirty days, and we test that the restore works once a week.
Everything your DPO needs is published
Our Data Processing Agreement, sub-processor list and Data Protection Impact Assessment are on the website. Your data protection officer can do the whole assessment without speaking to anyone.
OpenAI does not train on your school's data
We use the OpenAI tier where training on your content is switched off. Your documents and conversations belong to your school, and they stay there.
What to tell your DPO
UK GDPR and the Data Protection Act 2018
We've built Ask.School in line with the ICO's expectations. Our Data Protection Impact Assessment is kept up to date and shared on the website.
ICO Age-Appropriate Design Code
Children-facing chatbots default to safer settings. The chatbot can only see what it's allowed to share with each audience — at three different layers.
KCSIE Annex D
The filtering and monitoring duties Keeping Children Safe in Education sets out are met by the safety checks plus the conversation review tool your DSL uses.
Subject access requests
Encryption and the data isolation make subject access and erasure straightforward. Today these are handled by our support team — a self-service export is coming next.
Full detail in our DPA, sub-processor list and the safeguarding hub.
Ready to see this in your school?
Start a free 14-day trial. No credit card required. Cancel any time.