Procurement FAQ

Classfolio is designed to support schools' GDPR compliance obligations. Under UK GDPR, schools remain the Data Controller — Classfolio acts as the Data Processor, processing data only on the school's instructions to deliver the educational service.

Classfolio does not sell school, teacher or student data. Student data is not used to train AI models. Classfolio provides a Data Processing Agreement on request.

Classfolio is built on Google Cloud / Firebase. Primary application data is stored in Cloud Firestore within Google Cloud's London region (europe-west2). Uploaded files are stored in Firebase Storage, also within europe-west2. Server-side processing runs in Firebase Cloud Functions deployed in europe-west2. The web application is served via Firebase Hosting — Google's global CDN, which delivers static assets only and carries no personal data.

AI-assisted features use Google's Vertex AI platform, configured to process requests in the same Google Cloud London region (europe-west2) as everything else. Primary data, server-side processing, and AI processing are therefore all UK-resident. Full details are in the Data Processing Agreement.

Yes — Classfolio Ltd is Cyber Essentials certified, awarded 17 August 2026 and valid to 17 August 2027. Cyber Essentials is the UK National Cyber Security Centre's scheme, assessed through IASME. The assessed scope is the whole organisation rather than a single product or environment, and the certificate number is 3396ce0d-ef6c-4f34-9dd3-87259a7403f3, which you can verify independently on the IASME registry — there is a direct link on our Security page.

To be precise about what that covers: basic Cyber Essentials is a verified self-assessment marked by a qualified assessor, not a technical audit. Classfolio does not hold Cyber Essentials Plus, which adds independent hands-on technical testing, and does not hold ISO 27001 or SOC 2 — for those we rely on Google Cloud's own certifications for the underlying infrastructure. Classfolio has also not commissioned an independent penetration test. We would rather you knew that from us than found it out during a security review.

Yes. A full, signed Data Processing Agreement is available on request for schools and trusts that require one for procurement, DPIA, or compliance purposes.

To request a signed DPA, email privacy@classfolio.co.uk with your school or trust name, your role, and any specific requirements. We will respond within 5 working days.

Classfolio collects and processes the following student data: display names (which may be pseudonymous), class membership, assessment results and AI-assisted marks, assignment submissions and feedback, lesson participation responses, flashcard and retrieval grid progress.

Classfolio does not collect biometric data, continuous audio or video recordings, device location, or browsing history. There is no continuous monitoring of student activity beyond the responses students submit within the platform.

No. School, teacher and student data is never used to train or fine-tune AI models. This applies to all data processed by Classfolio.

Classfolio uses Google's Vertex AI platform (Google's Gemini models) for AI-assisted features. Text generation and marking are processed within Google Cloud's London region (europe-west2). AI image generation is the one exception: no image model is available in the UK region, so it runs on Google's global infrastructure — it is switched off unless your school turns it on, only teachers can use it, and requests contain nothing but a teacher's written description. Under Google's Vertex AI service terms, data submitted via the API is not used to train Google's models. When student answers are sent for AI marking, no student name, email, or identifying information is included — only the question definition and answer text.

Classfolio uses Microsoft and Google authentication via Firebase Authentication. All users — teachers, students, and administrators — sign in using an existing Microsoft or Google account. Classfolio does not manage user passwords directly.

Schools using Microsoft 365 or Google Workspace can use existing school-managed identities without creating additional passwords, simplifying onboarding and reducing credential overhead. Teacher accounts require admin approval before access to teaching tools is granted. All students sign in with their school Google or Microsoft account; teachers can then add students to classes directly or via a teacher-issued join code.

Schools and administrators can request deletion of data at any time by contacting privacy@classfolio.co.uk. When an account is deleted, it is soft-deleted with a 90-day retention period before permanent removal. Immediate anonymisation is also available on request.

Classfolio provides a structured GDPR request flow through which schools can submit data access, deletion, or export requests. These are processed and tracked with a full audit trail.

Classfolio is an educational delivery platform — it is not a safeguarding reporting system. Concerns about child welfare should always follow your school's established safeguarding procedures.

Key points for DSLs: Classfolio does not access, record, or store audio or video. There is no student-to-student messaging or communication. Students can only see their own work. Teachers control all content before it is visible to students. AI does not interact directly with students.

Yes. Individual teachers, departments, schools, and trusts can all use Classfolio. There is no minimum deployment size — individual teachers can start with a 14-day free trial, and schools can adopt it at departmental or whole-school level.

Trust-level administration tools — including cross-school analytics, central admin dashboards, and trust-level licensing — are in development. Schools and trusts deploying now will have input into how these features are shaped. Contact hello@classfolio.co.uk to discuss your trust's requirements.