Security

Last updated: 23 October 2026

StaffIQ holds the records schools rely on for safeguarding: pre-employment checks, identity documents and staff personal data. This page sets out how that data is hosted, protected and accessed.

1. Hosting

  • StaffIQ is hosted in the UK on Amazon Web Services (AWS), in the London region (eu-west-2). The application, the database and file storage all run there.
  • The database is a private PostgreSQL instance with no public access. Only the application can connect to it.
  • Automated database backups are kept for 30 days, and the production database has deletion protection enabled.

2. Encryption and documents

  • In transit: all traffic is encrypted (HTTPS/TLS 1.2 or higher). Plain HTTP requests are redirected to HTTPS.
  • Database: encrypted at rest (AES-256), and the application's connections to it are encrypted (TLS, with the server certificate verified).
  • Documents: uploaded files are stored in Amazon S3, encrypted at rest (AES-256).
  • The document store blocks all public access and accepts encrypted connections only. When a file is replaced or deleted, its previous version is kept for 30 days, then deleted.
  • Documents are never public links. Every download goes through StaffIQ, which checks that the person is allowed to see the file first.

3. Signing in

  • Two-factor authentication with an authenticator app (TOTP), email code or SMS code. Each code works once.
  • Organisations can require two-factor authentication for administrators or for every user. A user who hasn't set it up gets one more sign-in. After that, they must set it up before they can use StaffIQ.
  • Turning off two-factor authentication needs the user's password and a current code.
  • New users choose their own password from a single-use invitation link. StaffIQ never sends a password by email when it invites someone.
  • Passwords must be at least 12 characters. They are stored as salted bcrypt hashes, never in plain text.
  • Accounts are locked for 15 minutes after 5 failed sign-in attempts.

4. Access control

  • Role-based access, with roles such as Super Admin, School Admin, DSL, HR Support, Governor and Viewer. Nobody can give another user a role higher than their own.
  • Viewers and limited viewers have read-only access and can't download exports.
  • Permission groups can narrow which areas of StaffIQ a user can see. The same limits apply to the data behind those pages, not just the menu.
  • In a multi-academy trust, users can be limited to specific schools. They then see only those schools' records, everywhere in StaffIQ.
  • A change to a user's role, schools or permission groups applies straight away, not at their next sign-in. Deactivating a user ends their session.
  • Each organisation's data is kept separate in the application: queries are scoped to the signed-in user's organisation.

5. Audit logging

  • Creating, updating and deleting records is recorded in an audit log. So are report downloads, Inspector Mode activity, sign-ins (including failed sign-ins and two-factor checks) and attempts to open a page or action a user isn't allowed to use.
  • Each entry records who acted, what changed and when.
  • Sensitive values such as NI numbers and salary are not written to the audit log. Only the fact that the field changed is recorded. Passwords and sign-in codes are never logged.

6. Inspector Mode

Inspector Mode lets you share your Single Central Record with an inspector without creating an account for them.

  • Read-only: inspectors can view records and evidence but cannot change anything.
  • Time-limited: every link has an expiry date and stops working after it.
  • Revocable: you can revoke a link at any time.
  • Audit-logged: creating, viewing and revoking a link are all recorded, along with how often and when it was last used.

7. Our people

  • Everyone with access to customer data signs a confidentiality agreement and completes data protection training.

8. Incident response

  • We have a documented incident response procedure, with defined roles and escalation paths.
  • If a security incident affects your data, we notify you without undue delay, and in any event within 48 hours of becoming aware of it, as set out in our Data Processing Agreement.

9. Your data and your obligations

  • Your school or trust is the data controller. School IQ Labs Ltd is the data processor and acts on your instructions. See our GDPR page.
  • Staff data can be exported to Excel to help you respond to subject access and data portability requests.
  • Data retention settings let you choose how long records are kept after a member of staff leaves. Retention is off until you turn it on. Then a daily job archives leavers past that period and, if you choose, deletes archived records and leavers' documents.
  • If your account closes, you can ask us to export your data for 30 days. After that, your data and documents are permanently deleted. Audit logs are kept for 12 months after closure, then deleted. See our Data Processing Agreement (section 12).
  • The third-party services we use, and where they process data, are listed in our Privacy Policy.

10. Documents and questionnaires

Need our Data Processing Agreement or a security questionnaire completed? Contact us.