Organisational & Security Measures

🏛️ Standards, Frameworks & Compliance

Certifications held

Certification	Status	Scope
Cyber Essentials Plus	Certified (2026)	UK Government-backed cybersecurity baseline with independent technical verification
ICO registration	ZC093007	IANTZ LIMITED registered with the UK Information Commissioner's Office
PCI-DSS Level 1	Via Stripe (processor)	Card payments; iAntz does not store full cardholder data

ISO standards — practices aligned

Our security and privacy programme is aligned with the following ISO/IEC standards. These guide our policies, controls, and risk management. Unless stated as certified above, alignment does not mean third-party ISO certification of iAntz.

Standard	Focus	How we apply it
ISO/IEC 27001	Information security management (ISMS)	Risk assessments, security policies, access control, incident response, supplier management
ISO/IEC 27002	Security controls catalogue	Control selection and implementation across the platform and operations
ISO/IEC 27701	Privacy information management (PIMS)	UK GDPR programme, DPIAs, data subject rights, processor/controller documentation
ISO/IEC 27017	Cloud security controls	Shared responsibility, tenant isolation, and cloud-specific controls for AWS and Cloudflare
ISO/IEC 27018	PII protection in public cloud	Safeguards for pupil and parent data hosted in cloud infrastructure
ISO/IEC 42001	AI management systems	Governance, risk assessment, and human oversight for AI-assisted features

Core cloud infrastructure (AWS) is operated by a provider certified to ISO 27001, 27017, and 27018. See our data protection pack for school due diligence documents.

Other frameworks

Standard/Framework	Description
NIS2	Baseline measures for risk management, incidents, supply chains, and resilience (UK NIS framework)
AWS Well-Architected Framework	Secure, reliable cloud architecture across AWS Well-Architected pillars
UK GDPR / DPA 2018	Data protection compliance programme; privacy policy, DPAs, and DPIA support
WCAG 2.2 AA	Accessibility standard for parents, staff, and administrators

AI Governance (ISO/IEC 42001 aligned)

Our use of AI and large language models follows practices aligned with ISO/IEC 42001, the global standard for AI management systems. This covers responsible AI practices, transparent governance, risk assessment, and continuous improvement for AI-assisted features on our platform.

We use purpose-selected AI models from contracted providers for features such as reporting assistance, content drafting, and operational insights. Providers are assessed for security and data protection before use.

AI Data Protection Commitments:

• No customer PII used to train external AI models — contractually enforced with all providers
• Data minimisation enforced — only the minimum necessary data is passed to AI systems
• Prompts minimised — only the minimum necessary context is passed to AI systems
• AI access segregated from production databases by design
• Human review safeguards in place for AI-assisted operational decisions
• AI is not authorised to initiate payments or move funds. All payment execution is deterministic and rules-based; AI is used only for non-transactional functions such as categorisation, anomaly flagging, and content generation
• Data Processing Impact Assessments (DPIAs) completed for all AI use cases involving personal data
• AI providers contractually restricted from using iAntz data for model training

NIS2-aligned measures

We map our security programme to the baseline measures under NIS2 (and the UK NIS framework), including risk management, incident handling, business continuity, supply-chain security, and secure engineering.

Measure area	Our approach
Risk management and policies	Practices aligned with ISO/IEC 27001 and 27701; periodic risk assessments; documented security and privacy policies
Incident handling	Documented incident response plan, SIEM and alerting, defined escalation, and customer communication within stated SLAs
Business continuity and resilience	Published RTO/RPO targets, automated encrypted backups, and tested disaster recovery
Supply chain security	Processor due diligence, data processing agreements, contractual data-location controls, and subprocessor transparency
Secure acquisition, development, and maintenance	Infrastructure as Code, secure CI/CD with automated checks, SAST/DAST, dependency monitoring, and CREST-accredited penetration testing
Cryptography, access control, and training	Strong encryption in transit and at rest, MFA and least-privilege RBAC, Cyber Essentials Plus verification, and ongoing security awareness

🇬🇧 UK-Based Operations & Data Residency

• Core platform data — application data and PII processed and stored in AWS UK (London)
• Development, support, and administration run from the UK
• Full compliance with UK GDPR and UK data protection regulations
• Where third-party processors are used, we require appropriate contractual safeguards (including DPAs and, where needed, UK Standard Contractual Clauses)
• Key subprocessors are listed in the Data Processors section below; further detail is available on request for due diligence

☁️ Cloud Infrastructure

AWS Well-Architected Framework

Our platform is built primarily on Amazon Web Services (AWS), architected according to the six pillars of the AWS Well-Architected Framework:

Pillar	What This Means
Security	Defence in depth, identity management, and data protection at every layer
Reliability	Fault-tolerant architecture ensuring services remain available
Performance Efficiency	Optimised resources for fast, responsive user experiences
Cost Optimisation	Efficient infrastructure keeping costs sustainable
Operational Excellence	Automated operations, monitoring, and continuous improvement
Sustainability	Environmentally responsible cloud practices

Cloud Providers

• Primary: Amazon Web Services (AWS) — API, database, storage, and backend services (London region)
• Edge and delivery: Cloudflare — website and application hosting, CDN, DDoS protection, and web application firewall
• Uptime target: 99.99%
• Data residency: Core application data in the UK; some subprocessors may process limited data globally under contractual safeguards

🔧 Infrastructure as Code (IaC)

Repeatable, Auditable, Secure

• All cloud infrastructure defined in version-controlled code
• Every server, database, network configuration, and security rule managed as code
• Infrastructure changes go through code review and approval processes
• Complete audit trail of all infrastructure modifications
• Rapid environment rebuild capability from trusted code templates

Cloud Drift Detection & Monitoring

• Real-time drift detection comparing live infrastructure against defined templates
• Immediate alerting for any deviation from expected state
• Automated remediation restoring secure configurations where appropriate
• Root cause analysis for every drift event

Environment Segregation

• Segregated production, staging, and development environments with restricted production access
• No live data in test environments — masked and synthetic datasets used exclusively
• Restricted production access — requires explicit approval, MFA, and is fully logged
• Separate encryption keys per environment

🔐 Encryption

Data Protection

State	Encryption Standard
In Transit	TLS 1.3 enforced for all connections. TLS 1.2 supported only for legacy compatibility. HSTS enabled. Perfect Forward Secrecy enforced.
At Rest	AES-256-GCM for all stored data. Encryption keys segregated by environment and rotated automatically.

All data encrypted using AES-256-GCM

Key Management

• All encryption keys managed via AWS Key Management Service (KMS)
• Automatic key rotation enforced — no manual key handling
• Strict IAM separation of duties — no single person can access both keys and data
• Encryption keys segregated by environment — production, staging, and development keys are fully isolated
• Key usage audited in AWS CloudTrail for every cryptographic operation

Secrets Management

• All application secrets (API keys, credentials, tokens) stored in AWS Secrets Manager
• No secrets stored in code repositories — enforced at CI/CD pipeline level
• Secrets access logged and audited; access revoked immediately on personnel change
• Runtime secret injection — application containers never hold secrets at rest

🔑 Access Control & Identity Management

Role-Based Access Control (RBAC)

• Granular permissions assigned based on job function
• Segregation of duties preventing single points of compromise
• Easy onboarding/offboarding through role assignment
• Consistent permission enforcement across all users

Principle of Least Privilege

• Default-deny posture – access explicitly granted, never assumed
• Time-bound permissions – elevated access expires automatically
• Regular access reviews – periodic audits removing unnecessary access
• Just-in-time access – administrative privileges granted on-demand and logged

🔓 Authentication

Sign-In Options

• Email and password
• Passkeys (FIDO2/WebAuthn)
• Magic links (passwordless email sign-in)
• Social sign-in: Google, Apple, Microsoft, and Facebook (where enabled)

Multi-Factor Authentication (MFA)

• Authenticator apps (TOTP) — available for accounts that need an additional factor
• Passkeys — can satisfy strong authentication requirements without a separate second factor
• MFA can be required for sensitive roles or actions according to platform policy
• Re-authentication is required for high-risk actions (for example, account deletion)

Account Protection Controls

• Rate limiting and bot protection on authentication flows
• Secure, HTTP-only session cookies for web sign-in
• Password breach checking against known compromised-password databases
• Account lockout and alerting after repeated failed sign-in attempts
• Edge WAF and DDoS protection for public-facing services

📝 Audit Logging

Immutable Audit Logs

All user actions and system events captured in tamper-proof storage:

What We Log:

• User logins, logouts, and failed authentication attempts
• Data access, modifications, and deletions
• Permission changes and role assignments
• System configuration changes
• API access and third-party integrations
• Administrative actions and elevated access usage

Immutability Benefits:

• Forensic integrity for incident investigations
• Unalterable compliance evidence
• Insider threat protection
• Legal admissibility of records

🛡️ Vulnerability Management

Automated Infrastructure Scanning

• Regular automated vulnerability scanning of all infrastructure
• Vulnerabilities prioritised, tracked, and remediated according to strict SLAs
• Continuous hardening against emerging threats

Application Security Testing

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Security testing before every production release

Penetration Testing

• Annual independent penetration test by CREST-accredited external security experts
• Additional tests triggered after major architectural changes or new high-risk features
• Critical and high-severity findings receive external retest to confirm remediation
• Ethical hacking using real-world attack techniques (OWASP, PTES)
• Continuous automated scanning runs between point-in-time tests
• Findings addressed under strict SLA before potential exploitation

👨‍💻 Secure Development Practices

OWASP Top 10 Compliance

Protection against all major web application security risks:

• Injection attacks (SQL, NoSQL, command injection)
• Broken authentication and session management
• Sensitive data exposure
• Cross-site scripting (XSS) and request forgery
• Security misconfigurations
• Vulnerable components
• Insufficient logging

CI/CD Security Pipeline

Automated security analysis integrated into development workflow:

• Source code vulnerability scanning before deployment
• Dependency monitoring for outdated or insecure components
• Container and IaC misconfiguration detection
• Licence compliance verification
• Secrets detection preventing credential exposure
• Automatic deployment blocking when issues detected

Secure Coding Standards

• Developer security awareness training
• Security reviews embedded in code review process
• Shift-left security approach catching issues early

🖥️ Security Monitoring

Security Information & Event Management (SIEM)

Centralised security visibility and threat detection:

Capability	Description
Log Aggregation	Real-time collection and normalisation from all systems
Correlation Engine	Pattern identification across related events
Threat Detection	Behavioural analytics and threat intelligence
Automated Alerting	Immediate notifications for security events
Incident Timeline	Complete event reconstruction for investigations
Compliance Reporting	Audit-ready reports for regulatory requirements

Real-Time Monitoring

• Authentication and access anomalies
• Privilege escalation attempts
• Suspicious API usage
• Infrastructure and application health
• Transaction anomaly detection for fraud and safeguarding indicators

24/7 Threat Detection

• Continuous monitoring around the clock
• Security team response to identified threats
• Proactive threat hunting

🔄 Business Continuity

Recovery Objectives

Objective	Target	Description
RTO (Recovery Time Objective)	< 4 hours	Maximum time to restore full service following a critical failure
RPO (Recovery Point Objective)	< 1 hour	Maximum acceptable data loss window; backups run at least hourly
Uptime Target	99.99%	Equates to less than 52 minutes downtime per year

Backup & Recovery

• Automated backups with geographic redundancy within UK regions
• Backup data encrypted with the same AES-256-GCM standard as live data
• Backup access restricted by IAM policy — separate from production access roles
• Regular disaster recovery procedure testing with documented results
• Environment restoration from Infrastructure as Code within minutes

Incident Response

• Documented incident response plan tested quarterly
• Defined severity classifications with escalation paths and SLA response times
• Transparent customer communication protocols — affected schools notified within 72 hours for data incidents
• ICO notification within 72 hours where required under UK GDPR
• Root cause analysis and lessons learned processes for every P1/P2 incident

♿ Accessibility – WCAG 2.2 AA

We are committed to making Payments by iAntz accessible to everyone, including users with disabilities. Our platform is designed and developed to meet WCAG 2.2 Level AA standards, ensuring an inclusive experience for all parents, school staff, and administrators.

Our Accessibility Commitments

Principle	What We Do
Perceivable	Text alternatives for images, captions for media, sufficient colour contrast, and content that adapts to different screen sizes
Operable	Full keyboard navigation, no time-limited interactions, clear focus indicators, and skip navigation links
Understandable	Clear language, consistent navigation, predictable behaviour, and helpful error messages with suggestions
Robust	Semantic HTML, ARIA attributes, compatibility with assistive technologies including screen readers

Key Accessibility Features

• Fully keyboard-navigable interface with visible focus states
• Screen reader compatible with appropriate ARIA labels and landmarks
• Colour contrast ratios meeting WCAG AA minimum requirements
• Responsive design adapting to zoom levels up to 400%
• Respects user preferences for reduced motion
• Descriptive alt text for all meaningful images
• Form inputs with clear labels, instructions, and error identification
• Consistent and predictable navigation across all pages

👥 Staff Security

• Security awareness training for all team members
• Enhanced Disclosure and Barring Service (DBS) checks for all personnel with access to school or children's data
• Strict confidentiality agreements
• Regular security updates and briefings
• Admin accounts enforced to use strong MFA
• Insider threat controls — anomalous data access is reviewed

🏫 Safeguarding & Children's Data

iAntz processes data relating to children, including identities, financial transaction history, and potentially sensitive inferences such as Free School Meal status. We treat this data with the highest level of care.

• Data Protection Impact Assessments (DPIAs) conducted for all high-risk processing activities, particularly those involving children's data
• Transaction anomaly detection for fraud indicators and financial safeguarding signals
• Sensitive inferred data (e.g. FSM status) handled with additional access restrictions and audit controls
• Parental consent flows and age-appropriate data minimisation built into product design
• Regular safeguarding reviews with school DPO guidance considered in policy design
• No behavioural profiling of minors for commercial purposes

Enhanced Safeguarding Logging

Access to pupil and parent data is logged. Unusual access patterns (for example, out-of-scope lookups or bulk activity) are reviewed by our security team.

School Role Design & Least Privilege

Roles are pre-modelled around how schools actually operate — not generic IT roles:

• Purpose-built roles for Finance Officer, Class Teacher, School Admin, and MAT Central Team
• All roles are least-privilege by default — access is scoped to the minimum required for each function
• MATs can enforce central access policies across all schools in their trust, including MFA requirements and role ceilings
• School-level data is isolated per school; cross-school access requires explicit MAT-level authorisation
• Role assignments logged and subject to periodic access review

Data Sharing Boundaries

• We never sell, rent, or share pupil or parent data with third parties for commercial purposes
• No third-party advertising trackers in the application — verified by design and reviewed at each release
• Pupil and parent data is used solely to deliver and improve the iAntz service for that school
• No data is shared with other schools, trusts, or public bodies without explicit consent or lawful basis
• Analytics used internally only, on aggregated and anonymised data, never at individual pupil level

🗑️ Data Retention & Secure Deletion

• Defined retention schedules aligned with UK education sector guidance and GDPR requirements
• Financial and transaction records retained for 7 years where required by law; personal data anonymised on account deletion where possible
• Parents and guardians can download their data or delete their account in the app (see our Privacy Policy)
• Secure deletion and cryptographic erasure used when data reaches end of life
• Backup data subject to the same retention policies as live data

📊 Summary Table

Category	Measures
Standards & Frameworks	Certified: Cyber Essentials Plus (2026). Registered: ICO ZC093007. Aligned: ISO/IEC 27001, 27002, 27701, 27017, 27018, 42001. Also: UK GDPR, NIS2-aligned, WCAG 2.2 AA (designed to), PCI-DSS via Stripe
Data Residency	Core platform on AWS UK (London); website and app via Cloudflare; subprocessors under DPAs with appropriate safeguards
Infrastructure	AWS Well-Architected, Infrastructure as Code, environment segregation
Encryption	AES-256-GCM at rest; TLS 1.3 enforced in transit; HSTS; Perfect Forward Secrecy
Key Management	AWS KMS with automatic rotation; IAM separation of duties; per-environment key isolation
Secrets Management	AWS Secrets Manager; no secrets in code repositories; runtime injection only
Access Control	RBAC, Least Privilege, Just-in-Time Access, Default-Deny
Authentication	Passkeys, email/password, magic links, social sign-in (Google, Apple, Microsoft, Facebook), TOTP MFA, re-auth for sensitive actions
Payments & PCI-DSS	No card data stored; tokenised workflows via Stripe (PCI-DSS Level 1); immutable transaction ledger; automated reconciliation; fraud controls
Audit & Logging	Immutable Audit Logs; full action tracking; transaction anomaly detection
Development Security	OWASP Top 10, CI/CD Security Scanning, Secure Coding, Secrets Detection
Vulnerability Management	Annual + change-triggered CREST-accredited pen testing; external retest on critical findings; continuous automated scanning; dependency monitoring
Monitoring & Detection	SIEM, 24/7 Threat Detection, Real-time Alerting, Behaviour Analytics
Business Continuity	RTO <4h, RPO <1h; Automated Backups; Disaster Recovery Tested Quarterly
Safeguarding & Children's Data	DPIAs; enhanced insider-access logging; school role pre-modelling; MAT central policy enforcement; no ad trackers; no data sold or shared commercially
Data Retention & Deletion	UK education-aligned schedules; cryptographic erasure; GDPR deletion request fulfilment
AI Governance	ISO/IEC 42001 aligned; no PII used to train models; data minimisation; DPIAs for AI use cases
Responsible Disclosure	Public policy; [email protected]; 2-day acknowledgement SLA
Accessibility	WCAG 2.2 AA; keyboard navigation; screen reader support; reduced motion
Staff Security	DBS Checks, Security Training, Confidentiality Agreements, Insider Threat Controls

Our Data Processors

At iAntz, we are committed to transparency about how we handle your data. We work with carefully selected third-party service providers (data processors) to deliver our platform securely and efficiently. All processors are vetted for their security practices and compliance with UK data protection regulations.

Cloud Infrastructure

Processor	Purpose	Data Processed	Location
Amazon Web Services (AWS)	API, database, storage, email (SES), managed AI services, and backend services	Application data, logs, backups	UK (London) primary
Cloudflare	Website and app delivery, CDN, DDoS protection, WAF, and bot protection	Web traffic, access logs	UK/EU with appropriate safeguards

Authentication & Identity

Processor	Purpose	Data Processed	Location
Google, Apple, Microsoft, Facebook	Social sign-in (OAuth) where users choose these providers	User identifiers, email address, basic profile information	Provider-dependent; governed by DPAs
Google (Firebase)	Push notifications only (FCM)	Device tokens	Provider-dependent; governed by DPAs

Payment Processing & PCI-DSS Scope

Processor	Purpose	Data Processed	Location
Stripe	Card payments, wallet top-ups, and refunds	Payment metadata, transaction records (card data handled by Stripe)	UK/EU

Payment Integrity & Fraud Controls

Immutable ledger & reconciliation:

• Payment events are recorded in an append-only transaction ledger
• Automated reconciliation compares internal records against provider statements; discrepancies are investigated
• Schools and MATs can export transaction records for their own financial governance

Fraud & abuse controls:

• Configurable spend and top-up limits
• Anomaly detection on unusual payment patterns
• Duplicate payment prevention
• Segregated refund authorisation for higher-value refunds

Communications

Processor	Purpose	Data Processed	Location
Amazon SES	Transactional and service-related email	Email addresses, message content	UK/EU
Twilio	SMS and WhatsApp messaging (where enabled by schools)	Phone numbers, message content	UK/EU with appropriate safeguards

School Integrations

Processor	Purpose	Data Processed	Location
Wonde	MIS integration and pupil data synchronisation (as authorised by schools)	Pupil identifiers, names, class memberships	UK

Sales, Marketing & Customer Service

Processor	Purpose	Data Processed	Location
HubSpot	CRM, customer support, and marketing (with consent where required)	Contact information, communication history, support enquiries	EU hosting

Monitoring & AI

Processor	Purpose	Data Processed	Location
Sentry	Error monitoring and platform stability	Technical logs, minimised personal data	EU

AI-assisted features use contracted cloud AI services delivered through our AWS infrastructure. These are covered under our AWS data processing agreement; no customer PII is used to train public models.

Website & Network Security

Cloudflare is listed under Cloud Infrastructure above. All processors operate under data processing agreements and are reviewed periodically.

Our Commitments

• ✅ UK-primary hosting – Core application data is hosted in the UK; subprocessors are assessed and contracted appropriately
• ✅ Data Processing Agreements – We maintain formal agreements with all processors ensuring your data is protected
• ✅ Regular Reviews – We periodically review our processors to ensure they continue to meet our security and privacy standards
• ✅ Minimal Data Sharing – We only share the data necessary for each processor to perform their specific function
• ✅ Further detail on request – School DPOs can download our data protection pack or request additional due diligence at [email protected]

🔍 Responsible Disclosure

We believe in working with the security community to protect our users. If you believe you have discovered a security vulnerability in our platform, we encourage responsible disclosure.

• Report vulnerabilities to [email protected]
• We commit to acknowledging receipt within 2 business days
• We commit to providing a resolution timeline within 10 business days
• We will not take legal action against researchers acting in good faith
• We ask that you do not access, modify, or exfiltrate user data during research