Security
Education software security at Inclusion Studio: how learner support records are protected, what is built so far and what still needs independent testing.
Trust centre
Assurance roadmap
The independent checks, assessments and tests Inclusion Studio must complete before any real learner data is used, stated as gates rather than dates or promises.
In short
Inclusion Studio will not use real learner data until each gate on this page is passed, including independent security and privacy review, verified tenant isolation and file protection, a DPIA and contract assessment, and tested restores. We do not give dates or promise certifications.
Good intentions and well-known vendors do not make software safe for sensitive records. Evidence does. This page lists what must be true before Inclusion Studio holds any real learner’s information. Each item is a gate: if it is not passed, real data does not go in, however keen we or a pilot provider are to start.
We do not give dates for these gates, because a date can create pressure to pass a gate that is not ready. We do not promise any certification. If we gain one, we will say so here and link the evidence.
Where are we now?
Inclusion Studio is pre-pilot. A clickable prototype with fictional learners exists, and the production application is in development using synthetic data only. None of the gates below has been passed yet.
What are the gates before real learner data?
| Gate | What “passed” means | Status |
|---|---|---|
| 1. Independent security review | A suitably qualified independent party has reviewed the application and infrastructure, including a penetration test, and serious findings are fixed and retested | Not started |
| 2. Independent privacy review | An independent reviewer has checked data flows, retention, access and transparency against UK GDPR | Not started |
| 3. Tenant isolation verified | Tests show one organisation cannot read or change another’s records, including through search, exports, background jobs and AI | Designed, not yet verified |
| 4. File protection verified | Tests show documents cannot be fetched with guessed IDs, copied links or altered parameters; uploads stay quarantined until scanned; a scanning provider is chosen | Designed, not yet verified |
| 5. DPIA completed | A DPIA for the service is completed and reviewed, ready to support each pilot provider’s own DPIA | Not started |
| 6. Contracts and transfers assessed | Data processing agreements are in place with each subprocessor; international transfers are documented and assessed; a processor contract is ready for pilot providers | Not started |
| 7. Restore tested | Both the database and the document store have been restored from backup in a real test, with the result recorded | Not started |
| 8. Accessibility tested | Complete supported processes, including sign-in, account recovery, documents and error states, have been checked against WCAG 2.2 AA with manual assistive technology testing and testing by disabled people | Not started |
| 9. Named technical owner | A named person is responsible for production decisions and incident response, with a tested incident procedure | Not started |
| 10. Urgent route tested | The route for an urgent or safeguarding concern shows the right immediate contact, reaches a named person, is acknowledged, and has a tested fallback if nobody responds or the service is down | Not started |
| 11. Retention and rights tested | Retention schedules, deletion across files, search and backups, and requests from learners or their representatives have been tested end to end | Not started |
Why are these the gates?
They match the risks that matter most for learner support records:
- Wrong people seeing records. Gates 1, 3 and 4 test that permissions hold under attack, not just in normal use. See security.
- Unlawful or unexpected processing. Gates 2, 5 and 6 make sure the processing is understood, documented and contracted. See data protection and where data is processed.
- Losing records. Gate 7 proves recovery works. A backup that has never been restored is an assumption.
- Excluding the people it is for. Gate 8 tests the product with the assistive technology learners and staff actually use.
- Nobody in charge. Gate 9 makes sure incidents have an owner.
- Urgent concerns or old data left behind. Gates 10 and 11 check that urgent concerns reach a person and that data is kept, deleted and handed back as agreed.
What happens at each gate?
For each gate we will record what was checked, who checked it, what they found and what we changed. Where a pilot provider’s DPO or IT team needs to see evidence, we will share it under an appropriate agreement. Summaries will be published on this page.
Does passing these gates make Inclusion Studio “compliant”?
No. Passing these gates means we have evidence that the controls work at a point in time. Data protection and security are ongoing. Each provider using Inclusion Studio remains the controller for its learners’ data and must make its own assessment. Our DPIA guide explains what that involves.
What about certifications?
We hold none. We are not promising any. Some providers ask for a particular certification in procurement. If that applies to you, talk to us and we will tell you honestly whether and when we could meet it.
What will AI need before it uses real data?
AI has an extra gate of its own: a chosen provider and model, with documented processing locations, retention, training terms and fallback behaviour, plus testing on synthetic data. Until then AI uses mock drafts only. See our AI principles.
Sources and further reading
- Data protection impact assessments (ICO)
- Contracts and liabilities between controllers and processors (ICO)
- International transfers (ICO)
- Web Content Accessibility Guidelines (WCAG) 2.2 (W3C)
Official guidance changes. Check the source before relying on any detail, and take professional advice for individual cases.
Help shape the pilot
We are working with a small number of England FE colleges and apprenticeship providers first. Tell us about your learner support and we will be in touch.