Kindnesss · Trust
Security & Assurance
Child-centred kindness needs clear boundaries. Our approach combines guardian control, school-scoped permissions and documented security practices.
Access follows responsibility
Private workspaces require sign-in. Permissions are enforced at the data layer, not just by hiding buttons. School administrators, teachers and reporting viewers have distinct permissions. Group, country and area grants provide scoped aggregate reporting; they do not confer access to pupil records. School detail requires separate school staff membership.
A Passport under guardian control
Guardians authorise school links using expiring, single-use claims and can revoke them. A school transfer deactivates the previous enrolment while preserving source-labelled contributions and the family Passport. Each school retains only its own history; private Family Circle reflections and another school’s activity remain separate. Under-13s have no direct login.
Privacy in reporting and interchange
Aggregate school reports suppress cohorts smaller than five. OneRoster CSV files can be reviewed together, but only new active students from users.csv are imported after administrator confirmation. Existing pupils are not overwritten. Pilot measurement uses anonymous whole-group numbers, not identifiable allegations, discipline records or health information.
Recorded decisions and security checks
Passport link and transfer events, school import mapping decisions and pilot updates have application audit records. Permission regression checks use fictional identities in an isolated test database, not customer records. These checks support ongoing engineering review; they are not a guarantee that every risk has been eliminated.
Security documentation
Our internal security controls and evidence gaps are mapped to the AICPA Trust Services Criteria. The readiness register covers access control, monitoring, change management, incidents, vendors, backups, retention and minor safeguarding. Evidence and outstanding work are tracked internally; this statement describes our approach rather than providing independent assurance.
Translation without private page sharing
GTranslate, a third-party service, is optional and loads only after you deliberately click the Language control. On public pages it follows your cookie translation choice; on supported signed-in pages the click is a separate, session-only choice that resets on sign-out or account change. Checkout, password-recovery and one-time link pages do not load it. Once loaded, the provider script may be able to read what the page displays and browser state, and may process it outside the UK. Fields and personal content are marked as do-not-translate, but that marking is a hint to the translator, not an access control. Leave translation off if you prefer pages to stay in English.