The questions to ask before you let software touch pupil data
James Connolly · · 3 min read
Getting Classfolio ready for schools took far longer than building the features did. Certification, a data processing agreement, a record of processing, insurance, a tested restore — none of it shows up in the product, and all of it is what a school is entitled to ask about before a single pupil signs in.
The part that surprised me was the restore. We had backups configured and verified in July, and I would happily have told anyone we had a disaster recovery plan. Then I actually ran a restore against a scratch database to see what would happen. It took just under fourteen minutes and the data came back identical — but until that afternoon, 'we can recover' was a belief rather than a fact. That is the difference this checklist is trying to get at.
Most guidance on this is written for data protection officers. This is written for the teacher who has found a tool they like and now has to justify it, and for the leader who has to sign it off.
Who is the data controller?
The school is. Any supplier who suggests otherwise for a classroom tool has misunderstood their own product. The supplier is a processor, acting only on the school's written instructions.
Classfolio is a data processor, acting on written instructions from the school.
A good answer names the school as controller without hesitating, and can point at the clause in their agreement that says so.
Where does the data actually live?
Ask for a region, not a country, and not a reassuring adjective. "Secure servers" means nothing. "EU or UK" often means "whichever is cheaper this quarter".
Classfolio: United Kingdom (Google Cloud europe-west2).
Is there a data processing agreement you can actually read?
Not a promise of one. A document, available before you commit, with the sub-processors named. If a supplier cannot show you who else touches the data, they cannot tell you where it goes.
What certification do they hold — and what does it actually mean?
Classfolio holds Cyber Essentials, certified 17 August 2026 for the whole organisation, valid to 17 August 2027.
Basic Cyber Essentials is a verified self-assessment marked by a qualified assessor, not a technical audit. Classfolio does not hold Cyber Essentials Plus.
Be more reassured by a supplier who tells you the limits of their certification than by one who lets you assume it means more than it does.
Are they registered with the ICO?
It takes thirty seconds to check on the ICO's public register, and it is a reasonable thing to expect. Classfolio's registration is ZC215629.
What happens when something goes wrong?
Two questions, and the second is the one people forget. What is the breach process — who tells you, and how quickly? And: have they ever tested a restore, or do they simply have backups configured?
Configured backups and a tested restore are not the same claim. Ask which one they are making.
Are they insured, and for how much?
Classfolio holds £1,000,000 professional indemnity and £1,000,000 cyber and data cover with Hiscox Insurance Company Limited. The policy incepts on 1 September 2026. Each limit is in the aggregate and inclusive of defence costs. Losses from crime are covered to £50,000.
Ask for the limit, and ask whether defence costs sit inside or outside it. A modest limit that pays legal fees separately can be worth more than a headline figure that does not.
The shortest version
- Who is the controller? (It should be you.)
- Which region does the data live in?
- Can I read the DPA and the sub-processor list today?
- What certification, and what are its limits?
- Are you on the ICO register?
- What is the breach process, and have you tested a restore?
- What insurance, at what limit, and are defence costs inside it?
Seven questions. A supplier who answers all seven without flinching is not necessarily the right tool for your classroom — but they are one you can safely take to your data protection lead.
Classfolio is a teaching platform built by a teacher. See what it costs, or read why it exists.