At CimotaTech, we understand that when schools partner with us, they are trusting us with their most valuable asset: pupil data. Security, privacy, and compliance are not afterthoughts; they are the foundational architecture of everything we build.
We operate on a strictly transparent, read-only basis. We do not sell data, we do not serve advertisements, and schools retain absolute ownership of their records at all times.
1. Data Sovereignty & Hosting
Your data never leaves the UK. All CimotaTech infrastructure and databases are hosted exclusively on enterprise-grade Google Cloud servers located in UK data centers (London/Cardiff regions).
- Encryption: All data is encrypted both in transit (via TLS 1.3) and at rest (using AES-256 encryption).
- Scale-to-Zero Architecture: Our serverless infrastructure ensures that databases and compute instances are dynamically isolated and strictly controlled, minimizing attack surfaces.
2. Identity & Access Management (SSO)
We eliminate the biggest security vulnerability in EdTech: compromised passwords. CimotaTech platforms do not store user passwords.
- Enterprise SSO: We utilize enterprise grade software for secure Identity and Access Management, routing all authentication through the providers schools already trust.
- Supported Providers: We offer seamless, frictionless Single Sign-On via Google Workspace for Education, Microsoft Entra ID, and the Welsh Government’s Hwb platform.
3. Secure MIS Integration (Wonde)
Manual data exports via CSV are insecure and prone to human error. We have partnered with Wonde to provide a secure, automated bridge between your school’s Management Information System (MIS) and our platforms.
- Read-Only Access: CimotaTech only ever requests read-only access to the specific data points required to run our platforms (e.g., class rosters). We cannot overwrite or delete your MIS data.
- Absolute Control: School IT administrators can view our exact data permissions within the Wonde portal and can instantly revoke access with a single click.
- Automated Offboarding: When a pupil leaves your school and is removed from your MIS, they are automatically removed from our databases during the next sync.
4. GDPR & Regulatory Compliance
CimotaTech Ltd is fully compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We design our platforms using the principles of Privacy by Design and Default.
- Data Minimization: We only process the absolute minimum data required to deliver our educational interventions.
- Data Processing Agreement (DPA): We provide a comprehensive, transparent DPA for all partner schools and Multi-Academy Trusts.
View our standard Data Processing Agreement
Speak to our Data Protection Officer
If you, your MAT or Local Authority requires a custom security audit, or if you have specific questions regarding safeguarding and data infrastructure, our technical team is ready to assist.
Contact: compliance@cimotatech.com
Below we have listed all of our trust & compliance documentation for your review. If you have any questions or concerns make sure to contact us so we can discuss it further. Please note that all documents are given as samples and are reviewed upon every customer engagement to ensure that we satisfy the compliance, safeguarding, data protection and service needs of all of our customers at all times.
View our Trust and Compliance Documents
Data Protection Impact Assessment Template
View our DPIA template
View our DPIA template
We provide a sample template DPIA for our customers and partners to help them with onboarding and decision making
Read more
Example Service Level Agreement
View an example service level agreement (SLA)
View an example service level agreement (SLA)
Not sure what good looks like when we deploy our products and services? Take a look at a sample service level agreement. Please note though that all customer engagements warrant a discussion regarding the SLA's and in many cases we provide a unique / bespoke SLA per customer organisation.
Read more
ICO Children's Code Compliance Statement
View our ICO Children's Code Compliance Statement
View our ICO Children's Code Compliance Statement
Read more
Acceptable Use Policy (AUP) & Terms of Service
Read our AUP and ToS for our site and the Horizon Handwriting platform.
Read our AUP and ToS for our site and the Horizon Handwriting platform.
Accessibility Statement
Read on WCAG 2.2 Accessibility Statement
Read on WCAG 2.2 Accessibility Statement
Read more