Security & compliance for schools and MATs
Qwixl is built for UK education. This page explains roles, contracting, data protection, and security in plain terms — so your DPO, ICT, and procurement leads know what to expect before we send the full pack.
Who does what
For Qwixl:Academy, the school or multi-academy trust is the controller of pupil, staff, and parent personal data used for teaching and school administration. Qwixl Ltd (company number 17353629) is the processor for that Customer Data under a Data Processing Agreement (UK GDPR Article 28).
Wonde remains the school’s MIS integration provider under separate school–Wonde terms. Academy syncs only the permissions in our standard Required / Optional / Not requested schedule — we do not negotiate a bespoke category list per school.
Consumer products (Homework, Milo, Streams) follow the published Privacy Policy and Terms of Service. Academy schools use the Academy contract pack described below.
How contracting works
- Discovery — we confirm the signing entity (school vs trust), invoice entity, approximate numbers, preferred term, Pilot vs paid, AI image generation On/Off, whether optional school BYOK is required, DPO and safeguarding contacts, and whether Wonde is already in use.
- Standard pack — we send one Academy agreement pack (PDF). The Order Form carries parties and commercials; the MSA, Product Terms, DPA, SLA, and schedules are our standard terms.
- Your review — legal, DPO, and procurement review the pack. We answer diligence questions; we do not rewrite the product feature set per school.
- Sign and pay — completed Order Form; invoice per the Order Form.
- Go-live — tenant provisioned; Wonde connected with Required permissions; AI image and BYOK entitlements match the Order Form.
Order Form options are LLM Standard (included) with optional school BYOK (per-service key and model; if BYOK is unavailable or fails, Academy reverts to Standard automatically) and AI image generation On or Off only. Everything else in the Academy product set is included under the standard contract. There is no Premium LLM SKU.
What we send (and when)
At proposal / legal review (the client pack):
- Cover note
- Order Form
- Master Services Agreement
- Product Terms (including Close Contacts, acceptable use, GenAI, SEN)
- Data Processing Agreement and Wonde annex
- Wonde Permissions Schedule (Required / Optional / Not requested)
- Master SLA and schedules (platform, support, Wonde sync, incidents)
- Roadmap Schedule for Planned controls (non-warranty until Implemented)
- Privacy notices for staff, parents, and pupils (you complete the parties / DPO block before publishing locally)
- DPIA School Support Pack — our standard explanation so your DPO can complete your DPIA
After signature: invoice, Wonde connection instructions, and Required permissions confirmation before full functionality is promised.
On request during diligence: sub-processor list (DPA Annex III — Supabase West EU / Ireland; Vercel Dublin and London; OpenRouter EU exchange; Resend for adult transactional email only), transfer notes, and — when available under NDA — pen-test executive summary. Cyber Essentials and external pen-test are optional Planned items, not live warranties. We do not publish internal decision logs as client warranties.
Security posture
Production Academy and Qwixl services run on established cloud providers (including Vercel for application delivery in Dublin and London, and Supabase for managed Postgres in West EU / Ireland with row-level security). Access to APIs requires authenticated sessions and role checks. Data in transit uses TLS. Hosting providers supply encryption at rest for managed stores. Production AI routing uses OpenRouter’s EU exchange.
Implemented contractual technical and organisational measures are those listed as live in the Academy DPA Annex II (authentication and role checks; Close Contact controls as released; TLS; host encryption at rest; breach notification process).
Planned (explicitly non-warranty until evidenced and promoted) includes items such as automated retention enforcement with production evidence, self-serve data-subject tooling, dedicated SEN access audit logging, Cyber Essentials certification, independent penetration test with a sharable summary, and per-school Wonde credential isolation. We state these on the Roadmap Schedule for complete transparency purposes.
Report security and/or privacy concerns to support@qwixl.com.
Data protection
- Lawful basis — you decide Article 6 (and Article 9 for SEN) for your processing; we process on your documented instructions.
- SEN and special category data — SEN sync is a Required Wonde permission for Academy. Close Contacts may see identifiable pupil/SEN context; other staff see anonymised or aggregated views per Product Terms. Signals support professional review; they are not diagnoses and do not replace statutory SEN or safeguarding duties.
- AI — we do not use identifiable pupil data to train foundation models for other customers. Anonymised or aggregated data may be used to improve the product. Standard LLM is included. Optional school BYOK routes prompts to the school’s chosen provider under the school’s arrangement with that provider; if BYOK fails or is switched off, Academy reverts to Standard. AI image generation follows the Order Form.
- Exit — normal end: export window then deletion window as in the DPA. Non-payment: arrears and grace period rules apply before we may delete.
- Incidents — we notify without undue delay and aim to support your 72-hour controller timeline where we are processor.
Can we pick modules or turn off SEN sync?
No. Academy is one standard product. Order Form options are Standard LLM (optional school BYOK) and AI image generation On/Off only. SEN is Required in the Wonde Permissions Schedule and is a condition of the Service. Optional Wonde categories may be declined, with related features reduced.
Will you sign our school or MAT DPA instead?
We use our Academy DPA because it maps to the live product, Wonde schedule, and sub-processors. We answer diligence questions against that pack. We do not rewrite the product feature set per school.
What is the liability position?
Liability is capped at twelve months’ Academy Fees. Liability the law does not allow us to limit remains uncapped. Details are in the MSA.
Do you have Cyber Essentials or a pen-test report today?
Cyber Essentials and an independent pen-test summary are on our Planned controls roadmap.
What changes on a pilot?
The same document pack applies. If the Order Form marks Pilot = Yes, SLA service credits do not apply.
Ready for the full pack?
Tell us your school or trust, DPO contact, and target go-live. We will send the standard Academy contract and data-protection pack and walk your team through diligence questions.
Have a private onboarding link?
After discovery, Qwixl sends a private onboarding URL (not listed publicly). Use that link to download the standard pack and submit Order Form details. If you do not have a link yet, contact us or apply for Academy beta.