Security & Infrastructure

How Classfolio protects school, teacher and student data.

For IT Managers, Network Managers, and technical procurement teams evaluating Classfolio.

Security enquiries GDPR & Data Protection

Certification

Cyber Essentials certified

Classfolio Ltd holds Cyber Essentials certification, the UK National Cyber Security Centre’s scheme, assessed and awarded through IASME. The assessed scope is the whole organisation — not a single product or environment.

Certified:: 17 August 2026
Valid to:: 17 August 2027
Scope:: Whole organisation
Question set:: IASME v3.3 (Danzell)

Certificate number 3396ce0d-ef6c-4f34-9dd3-87259a7403f3. You can verify it independently on the IASME registry rather than taking our word for it.

Verify this certificate

To be precise about what this is: basic Cyber Essentials is a verified self-assessment marked by a qualified assessor, not a technical audit. Classfolio does not hold Cyber Essentials Plus, which adds hands-on technical testing, and does not hold ISO 27001 or SOC 2 — see below.

Insurance

Classfolio Ltd holds £1,000,000 professional indemnity and £1,000,000 cyber and data insurance with Hiscox Insurance Company Limited, in force from 1 September 2026. Each limit is in the aggregate and inclusive of defence costs. A certificate of either cover is available on request — ask and we will send it.

Authentication

Identity and authentication

Classfolio uses Firebase Authentication — Google's managed identity service — to handle all sign-in. Authentication is provided through Microsoft and Google identity providers. Classfolio does not manage user passwords directly.

All users — teachers, students, and administrators — sign in using an existing Microsoft or Google account. No separate Classfolio password is created or stored.

Google sign-in

Google OAuth via Firebase Authentication. Users sign in with their existing Google account. Schools using Google Workspace for Education benefit from school-managed identity with no additional setup.

Microsoft sign-in

Microsoft OAuth via Firebase Authentication. Users sign in with their existing Microsoft account. Schools using Microsoft 365 for Education benefit from school-managed identity with no additional setup.

No passwords managed

Classfolio does not issue, store, or reset user passwords. Credential management is handled by Microsoft or Google, reducing phishing exposure, credential-stuffing risk, and password support burden.

Account approval workflow

New teacher accounts require admin approval before they can access the platform. Suspended accounts are blocked at authentication.

Access Controls

Role-based access controls

Access to all data in Classfolio is enforced at the database level using Firestore security rules — not just at the application layer. Each request is evaluated against the authenticated user's role and ownership before data is returned.

Teacher

Create and manage own classes
Create lessons, assessments, assignments
Access own students' results and work
Access shared lessons from colleagues
Cannot access other teachers' private classes

Student

View own assessment results
Submit own assignment responses
Access own revision materials
Cannot read other students' data
Cannot modify marking or feedback fields

Admin

View all teacher accounts
Approve or suspend accounts
Access platform audit logs
View AI usage statistics
Can read lesson and assessment content
Cannot read student responses or submissions

Database-level enforcement

Classfolio uses Cloud Firestore security rules — over 2,500 lines of enforced access logic — to validate every database read and write. A student request for another student's assessment results is rejected at the database layer, not just hidden in the user interface.

Network Security

Transport and browser security

All traffic between users and Classfolio is served over HTTPS, enforced by Firebase Hosting. Security headers are configured on every response to reduce common browser-based attack surfaces.

HTTPS / TLS

Enforced

All connections are encrypted in transit. HTTP requests are automatically redirected to HTTPS by Firebase Hosting.

X-Frame-Options

SAMEORIGIN

Prevents Classfolio pages from being embedded in iframes on third-party sites, protecting against clickjacking attacks.

X-Content-Type-Options

nosniff

Prevents browsers from MIME-type sniffing responses — reduces risk of content injection attacks.

Referrer-Policy

strict-origin-when-cross-origin

Limits referrer information shared when navigating to external sites, reducing data leakage.

Permissions-Policy

camera=(), microphone=(self), geolocation=()

Camera and location are blocked outright — no Classfolio page can request them. The microphone is permitted for Classfolio's own pages only, and is used for two things. A pupil can speak an answer aloud in an AI-led lesson: the browser performs the speech recognition (Chrome sends the audio to Google's speech service and Edge to Microsoft's, under the browser's own terms) and only the resulting text reaches Classfolio, so no pupil audio is sent to or stored by us. Typing is always available instead. And a teacher can press Record to narrate their own lesson slides or record an audio clip for a task or question, which stores that recording of the teacher's voice with the lesson, assignment or assessment. Pupils are never recorded. The browser asks for permission either way, and nothing records without it.

Static asset caching

1 year (immutable)

Static files are served with long cache lifetimes and content-addressed filenames to ensure browser cache integrity.

API authentication

Firebase Auth tokens

All API calls from the browser are authenticated using short-lived Firebase ID tokens, not long-lived API keys.

App Check

Enforced on server API calls

Every server-side function call must present a valid Firebase App Check token, backed by reCAPTCHA Enterprise, so requests from outside the real Classfolio app are rejected before any code runs.

Rate limiting

Per user, per feature

AI calls are rate-limited per user per feature with per-minute burst limits. Administrators can additionally set daily per-teacher limits and disable AI features entirely.

Infrastructure

Google Cloud / Firebase infrastructure

Classfolio is built on Google's Firebase platform — a managed cloud infrastructure used by millions of applications worldwide. This means platform availability, maintenance, and infrastructure patching are managed by Google.

Firebase Hosting

Static web application files served via Firebase Hosting — a Google-managed CDN. No web server to patch or maintain.

Cloud Firestore

All application data is stored in Cloud Firestore — Google's fully managed, serverless NoSQL database with built-in encryption at rest, deployed in Google Cloud's London region (europe-west2).

Firebase Authentication

Authentication is handled by Firebase Auth — Google's managed identity service. No passwords are stored in Classfolio's own database.

Firebase Storage

Uploaded files (lesson images, resource documents) are stored in Firebase Storage — Google's managed object storage with encryption at rest, deployed in Google Cloud's London region (europe-west2).

Cloud Functions

Server-side processing (AI marking, data exports, GDPR operations) runs in Cloud Functions — Google's serverless compute platform, deployed in Google Cloud's London region (europe-west2).

Google Secret Manager

API keys and credentials for third-party services are stored in Google Secret Manager, not in application code or environment files. AI processing (Vertex AI) authenticates using Google Cloud's own credential system rather than a stored API key.

Infrastructure maintenance is handled by Google. Firebase infrastructure availability, OS-level patching, and hardware maintenance are all managed by Google as part of the Firebase platform service.

Encryption

Data encryption

Classfolio encrypts data both in transit and at rest using standard Google Cloud / Firebase defaults. No additional application-layer encryption is applied — encryption is handled at the infrastructure level by Google.

Encryption in transit

All communication between users and Classfolio is encrypted using HTTPS/TLS, enforced by Firebase Hosting. Connections to the database and storage are also encrypted in transit.

Encryption at rest

Data stored in Cloud Firestore, Firebase Storage, and Cloud Functions is encrypted at rest by default using Google-managed encryption keys — the standard Google Cloud encryption model.

Secrets management

API keys, service credentials, and secrets are stored in Google Secret Manager. They are not stored in application code, environment files, or version control.

AI & Data

How AI is used safely

Classfolio uses Google's Vertex AI platform (Gemini models) to assist teachers with content creation and to mark student short answers. Text generation and marking are processed within Google Cloud's London region (europe-west2). AI image generation is the one exception, and is described below. The integration is designed to minimise data exposure.

Teacher-activated only

AI is only called when a teacher explicitly uses an AI feature (generate lesson, mark response, generate resource). AI is never called automatically in the background.

No student identity data sent to AI

When student answers are sent to Vertex AI for marking, no student name, email, ID, or any personally identifying information is included in the request — only the question definition and the answer text.

Prompt injection protections

Student answer text is submitted as untrusted content in AI marking prompts. The model is explicitly instructed not to follow instructions embedded within student answers.

No AI model training on school data

School, teacher and student data is not used to train or fine-tune AI models. Classfolio uses Google Vertex AI; under Google's Vertex AI service terms, data submitted via the API is not used to train Google's models.

AI processing stays in the UK by default

Unlike many EdTech AI integrations, Classfolio's AI processing is pinned to Google Cloud's London region (europe-west2) — the same region as all other Classfolio data. Two things run outside that region. AI image generation runs on Google's global infrastructure because no image model is available in the UK region; it is switched off unless a school turns it on, only teachers can use it, and it never receives pupil data. Read Aloud, which speaks text to a pupil who asks for it, uses Google's EU text-to-speech endpoint rather than the London region, and the audio it returns is cached back in London. No recording is ever made of anyone's voice.

Rate-limited AI access

AI calls are rate-limited per user per feature with per-minute burst limits. Administrators can set daily per-teacher limits and disable AI features platform-wide.

Teacher review before publication

All AI-generated content is presented as a suggestion for teacher review and editing. AI does not publish content directly to students without teacher approval.

Data Management

Export, deletion and audit

Classfolio has server-side functions for data export, soft deletion, anonymisation and audit logging — built to support GDPR obligations and school data governance requirements.

Data export

Administrators can request a structured export of user data. Class analytics can be exported to XLSX.

GDPR request flow

Users can submit data access or deletion requests through the platform. Requests are tracked in an audited collection.

Soft deletion

Deleted accounts are soft-deleted with a 90-day retention window before permanent removal. Anonymisation is available for immediate identity removal.

Audit logging

Administrative actions are logged to a dedicated audit collection. Audit logs are retained for 365 days by default.

Backup & recovery

Point-in-time recovery is enabled on Cloud Firestore, giving continuous 7-day recovery to any moment. Daily scheduled backups are retained for 14 days, database delete protection is on, and uploaded files are kept as recoverable versions for 30 days after being changed or deleted. All backup data stays in europe-west2.

Automated retention enforcement

A scheduled job runs nightly at 02:30 (UK time) and enforces every retention window automatically: soft-deleted accounts are anonymised, and expired audit logs and archived session data are deleted (a minimal record of which pupils took part in each lesson is kept with the class). Expired unused media is flagged automatically, with an administrator confirming the final, irreversible deletion.

Transparency

What we don't yet claim

We want to be straightforward with IT teams and technical procurement staff about the current state of our security posture.

Cyber Essentials Plus

We hold basic Cyber Essentials (see above), which is a verified self-assessment. Plus adds an independent hands-on technical audit, and we have not completed it.

ISO 27001 or SOC 2 certification

Not currently certified. We rely on Google Cloud's own compliance certifications for infrastructure-level controls.

Specific uptime or availability SLA

Uptime is subject to Firebase platform availability. We do not publish a separate SLA.

Independent penetration testing

We have not commissioned an independent penetration test. Security is reviewed internally.

Specific incident response timeframes

We are committed to responsible disclosure and prompt communication in the event of a security incident, but do not currently publish a formal SLA.

GDPR & Data Protection

Data controller, processor, student privacy, subprocessors

Safeguarding

What Classfolio does and does not do in a school safeguarding context

Data Processing Agreement

DPA summary and how to request a signed agreement

Accessibility

Accessibility features and our commitment to inclusive design

Get in touch

Security and technical enquiries

If you have questions about Classfolio's security posture, infrastructure, or technical implementation — for a procurement review, DPIA, or IT sign-off — please get in touch.

hello@classfolio.co.uk Data Processing Agreement