The standards that protect school data

Access Control & Identity Management

Role-Based Access Control (RBAC)

• Granular permissions assigned based on job function
• Segregation of duties preventing single points of compromise
• Easy onboarding/offboarding through role assignment
• Consistent permission enforcement across all users

Principle of Least Privilege

• Default-deny posture – access explicitly granted, never assumed
• Time-bound permissions – elevated access expires automatically
• Regular access reviews – periodic audits removing unnecessary access
• Just-in-time access – administrative privileges granted on-demand and logged

Authentication

Sign-In Options

• Email and password
• Passkeys (FIDO2/WebAuthn)
• Magic links (passwordless email sign-in)
• Social sign-in: Google, Apple, Microsoft, and Facebook (where enabled)

Multi-Factor Authentication (MFA)

• Authenticator apps (TOTP) — available for accounts that need an additional factor
• Passkeys — can satisfy strong authentication requirements without a separate second factor
• MFA can be required for sensitive roles or actions according to platform policy
• Re-authentication is required for high-risk actions (for example, account deletion)

Account Protection Controls

• Rate limiting and bot protection on authentication flows
• Secure, HTTP-only session cookies for web sign-in
• Password breach checking against known compromised-password databases
• Account lockout and alerting after repeated failed sign-in attempts
• Edge WAF and DDoS protection for public-facing services

Audit Logging

Immutable Audit Logs

All user actions and system events captured in tamper-proof storage:

What We Log:

• User logins, logouts, and failed authentication attempts
• Data access, modifications, and deletions
• Permission changes and role assignments
• System configuration changes
• API access and third-party integrations
• Administrative actions and elevated access usage

Immutability Benefits:

• Forensic integrity for incident investigations
• Unalterable compliance evidence
• Insider threat protection
• Legal admissibility of records

Vulnerability Management

Automated Infrastructure Scanning

• Regular automated vulnerability scanning of all infrastructure
• Vulnerabilities prioritised, tracked, and remediated according to strict SLAs
• Continuous hardening against emerging threats

Application Security Testing

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Security testing before every production release

Penetration Testing

• Annual independent penetration test by CREST-accredited external security experts
• Additional tests triggered after major architectural changes or new high-risk features
• Critical and high-severity findings receive external retest to confirm remediation
• Ethical hacking using real-world attack techniques (OWASP, PTES)
• Continuous automated scanning runs between point-in-time tests
• Findings addressed under strict SLA before potential exploitation

‍💻 Secure Development Practices

OWASP Top 10 Compliance

Protection against all major web application security risks:

• Injection attacks (SQL, NoSQL, command injection)
• Broken authentication and session management
• Sensitive data exposure
• Cross-site scripting (XSS) and request forgery
• Security misconfigurations
• Vulnerable components
• Insufficient logging

CI/CD Security Pipeline

Automated security analysis integrated into development workflow:

• Source code vulnerability scanning before deployment
• Dependency monitoring for outdated or insecure components
• Container and IaC misconfiguration detection
• Licence compliance verification
• Secrets detection preventing credential exposure
• Automatic deployment blocking when issues detected

Secure Coding Standards

• Developer security awareness training
• Security reviews embedded in code review process
• Shift-left security approach catching issues early

Security Monitoring

Security Information & Event Management (SIEM)

Centralised security visibility and threat detection:

Real-Time Monitoring

• Authentication and access anomalies
• Privilege escalation attempts
• Suspicious API usage
• Infrastructure and application health
• Transaction anomaly detection for fraud and safeguarding indicators

24/7 Threat Detection

• Continuous monitoring around the clock
• Security team response to identified threats
• Proactive threat hunting

Business Continuity

Recovery Objectives

Live service status: status.iantz.com

Backup & Recovery

• Automated backups with geographic redundancy within UK regions
• Backup data encrypted with the same AES-256-GCM standard as live data
• Backup access restricted by IAM policy — separate from production access roles
• Regular disaster recovery procedure testing with documented results
• Environment restoration from Infrastructure as Code within minutes

Incident Response

• Documented incident response plan tested quarterly
• Defined severity classifications with escalation paths and SLA response times
• Transparent customer communication protocols — affected schools notified within 72 hours for data incidents
• ICO notification within 72 hours where required under UK GDPR
• Root cause analysis and lessons learned processes for every P1/P2 incident

At iAntz, we are committed to transparency about how we handle your data. We work with carefully selected third-party service providers (data processors) to deliver our platform securely and efficiently. All processors are vetted for their security practices and compliance with UK data protection regulations.

Cloud Infrastructure

Authentication & Identity

Payment Processing & PCI-DSS Scope

Payment Integrity & Fraud Controls

Immutable ledger & reconciliation:

• Payment events are recorded in an append-only transaction ledger
• Automated reconciliation compares internal records against provider statements; discrepancies are investigated
• Schools and MATs can export transaction records for their own financial governance

Fraud & abuse controls:

• Configurable spend and top-up limits
• Anomaly detection on unusual payment patterns
• Duplicate payment prevention
• Segregated refund authorisation for higher-value refunds

Communications

School Integrations

Sales, Marketing & Customer Service

Monitoring & AI

AI-assisted features use contracted cloud AI services delivered through our AWS infrastructure. These are covered under our AWS data processing agreement; no customer PII is used to train public models.

Website & Network Security

Cloudflare is listed under Cloud Infrastructure above. All processors operate under data processing agreements and are reviewed periodically.

Our Commitments

• UK-primary hosting – Core application data is hosted in the UK; subprocessors are assessed and contracted appropriately
• Data Processing Agreements – We maintain formal agreements with all processors ensuring your data is protected
• Regular Reviews – We periodically review our processors to ensure they continue to meet our security and privacy standards
• Minimal Data Sharing – We only share the data necessary for each processor to perform their specific function
• Further detail on request – School DPOs can download our data protection pack or request additional due diligence at compliance@iantz.com