For schools
Data protection
What your data protection lead needs, in one place.
Data processing agreement
Your school is the data controller for pupil and staff information it puts into Atlas. EDS Education Ltd (company 11334874) acts as your processor, only on your written instructions under a data processing agreement.
The companies we use
| Company | What for | Where |
|---|---|---|
| Supabase | What for: Database, sign-in, file storage | Where: Ireland (EU West) |
| Vercel | What for: Hosting the site | Where: Dublin (functions) |
| Resend | What for: Sending emails | Where: Sent from Ireland; delivery records in the United States (covered by Standard Contractual Clauses and the UK International Data Transfer Addendum) |
| OpenAI | What for: Marking help, reading uploaded work and Ask Atlas | Where: United States (covered by Standard Contractual Clauses and the UK International Data Transfer Addendum) |
| Anthropic | What for: Reading uploaded work and Ask Atlas | Where: United States and other countries (covered by Standard Contractual Clauses and the UK International Data Transfer Addendum) |
| Stripe | What for: Payments (families only) | Where: United States (covered by the UK-US data bridge and Standard Contractual Clauses) |
| What for: Sign in with Google, Google Classroom | Where: United States and other countries (covered by the UK-US data bridge and Standard Contractual Clauses) | |
| GitHub | What for: Our private code (no school data) | Where: United States (covered by the UK-US data bridge and Standard Contractual Clauses) |
We do not sell personal data. Where a supplier processes data outside the UK, appropriate transfer safeguards are in place.
How long we keep things
| Kind of data | Kept for | How it goes |
|---|---|---|
| Homework, marks and feedback | Kept for: While your school uses Atlas | How it goes: Your school can ask us to delete them |
| Live work receipts | Kept for: 90 days | How it goes: Deleted every night |
| Times a pupil left a homework page | Kept for: Until the end of that school year | How it goes: Deleted every night |
| Question reports | Kept for: 365 days | How it goes: Deleted every night |
| Uploaded written work (essay marking) | Kept for: 90 days | How it goes: Files deleted every 10 minutes once due |
| Test paper uploads not saved into a paper | Kept for: 48 hours | How it goes: Deleted |
| Messages sent to parents in bulk | Kept for: 365 days | How it goes: Deleted |
| Family invites | Kept for: 30 days | How it goes: Expire |
| Parent activation invites (school setup) | Kept for: 60 minutes | How it goes: Expire |
| An account deletion request | Kept for: 30 days (it can be stopped until then) | How it goes: Deleted with its files; checked every 10 minutes |
| Backups | Kept for: 7 days | How it goes: Rolled over daily |
Security in short
- Hosted in Ireland: the database and files in EU West, the site in Dublin. The UK recognises the EU as giving adequate protection for personal data.
- Sensitive children's information is encrypted in the database (AES-256-GCM).
- Each school, class and pupil sees only their own data (row-level security on every table).
- Pupils' files are in private storage; links to them last an hour at most.
- Admin actions that change data are written to an audit log.
- Uploads are checked for type, size and real file content. Atlas does not run a dedicated malware scanner.
- Daily backups; a full restore was rehearsed on 28 Aug 2026 (under 3 minutes).
- Two-step sign-in is available for staff, and we recommend it for everyone who manages your school's account.
If a breach affects your data, we tell you without undue delay so you can meet the 72-hour ICO deadline, and we help you tell parents.
Ready answers for your DPIA
| DPIA question | Answer |
|---|---|
| What data? | Names, school emails, classes, homework, answers, marks, feedback; parents' contact details when the school links them. |
| Why? | To set, do and mark homework and assessments and show progress to the school (and parents the school links). |
| Lawful basis | Public task (Article 6(1)(e)) for state schools; legitimate interests for independent schools. Your school confirms its own basis. |
| Who can see it? | The pupil, their teachers and school leaders; parents only for children the school links; Atlas support only when you ask, read-only and logged. |
| Where is it? | Ireland (EU) for the database and files; see the companies above. |
| How long? | See “How long we keep things” above. |
| Children's Code | Atlas is designed to the ICO Age Appropriate Design Code: high privacy by default, no selling or advertising, no nudges to share more. |
| Risks and how we reduce them | We have a DPIA template filled in with our answers and a risk table. Download it above and check it with your own risks. |
Contact
Privacy lead: Sahil Ahmad, support@edseducation.com. We do not currently have a formal Data Protection Officer.
You can also complain to the Information Commissioner's Office (ico.org.uk).