Your data stays in the UK
Pupil information is stored in UK data centres and processed under UK GDPR, including all AI processing.
Security
Supporting your most vulnerable pupils, securely.
At Spiro, we're grateful for the opportunity to support your school — which is why we take security and privacy so seriously.
Our commitments
Spiro's commitments to keeping your data safe.
AI that's safe for pupil data
All AI processing happens in the UK. No pupil information is retained by an AI provider or used to train models.
You control who sees what
Set visibility pupil by pupil and role by role. Ensure staff see everything they need to, and nothing more.
Built on leading infrastructure
Spiro is hosted on platforms certified to ISO 27001 and SOC 2 Type 2 to keep your data secure.
Security
How we keep your data safe.
Data protection
How your pupils' information is stored and handled:
- Pupil data stored and processed in the UK
- Encrypted in transit with TLS, and at rest with AES-256
- Data handled under UK GDPR and the Data Protection Act 2018
- AI processing in the UK, with zero retention and no training use
- Export on request; secure deletion within 90 days of termination
Access and permissions
How you control who sees each pupil's information:
- Multi-factor authentication
- Per-pupil visibility, set by your SENCO
- Role-based access controls
- Teachers see only the pupils they're responsible for
- Each school's data is isolated at the database level
Platform security
How the platform itself is protected:
- Hosted in the UK on ISO 27001-certified and SOC 2 Type 2-attested platforms
- Automated backups, with restores tested periodically
- Security measures reviewed and updated on a documented cycle
- Every sub-processor assessed before onboarding and bound by contract
Governance and accountability
How we run Spiro, and who's answerable:
- Formal risk assessment strategy, reviewed regularly
- Documented incident response plan, with breaches notified to you within 48 hours
- Least-privilege internal access with MFA enforced and access rights reviewed periodically
Artificial intelligence
Our approach to AI
At Spiro, we think AI can increase the human part of SEN provision rather than replace it. By taking the repetitive paperwork off your team, keeping every pupil's plan tailored and measurable, and surfacing what might otherwise be missed, Spiro aims to give you back the hours that hands-on support actually needs.
However, it's critical that we leverage AI thoughtfully and securely. As such, none of Spiro's AI suggestions or document drafts reach a pupil's record until a member of staff has reviewed and approved. Additionally, Spiro's AI runs entirely in the UK, under agreements that mean nothing is kept by the AI provider afterwards and nothing is used for training.
How Spiro uses AI, in fullDOCUMENTATION
Need additional documentation?
For customers conducting security reviews, security and compliance documentation is available via our Wonde profile.
Access documentationSee Spiro in action
Let us walk you through Spiro's secure platform.
We're happy to have your school's DPO join the call.