Security & compliance

Qwixl Ltd (company number 17353629). Last updated: 24 July 2026.

Last updated: 24 July 2026 Legal entity: Qwixl Ltd (company number 17353629), Old Furnace Cottage, Greendale, Oakamoor, Stoke-On-Trent, ST10 3AP, United Kingdom Product: Qwixl Academy (academy.qwixl.com)

This page explains roles, contracting, data protection, and security for Qwixl Academy in plain terms — so DPO, ICT, and procurement leads know what to expect before we send the full school pack.

It is a diligence overview. It does not replace the signed Academy Agreement (Order Form, MSA, Product Terms, DPA, SLAs) or the public Privacy Policy and Terms of Service.

Key points

• For Academy Customer Data, the School (or MAT) is the controller; Qwixl Ltd is the processor under a UK GDPR Article 28 DPA.
• Wonde remains the School’s MIS integration partner under separate School–Wonde terms. Academy syncs only the standard Required / Optional / Not requested schedule.
• One standard contract pack. Order Form options are LLM (Standard included; optional BYOK) and AI image generation (On / Off) only.
• SEN-related signals are for professional review — not diagnoses. Identifiable SEN detail follows Close Contacts rules.
• We do not use identifiable pupil data to train foundation models for other customers.
• Cyber Essentials and an independent pen-test summary are on the Planned controls roadmap until evidenced — we do not claim them as live warranties today.

Jump to: Who does what · How contracting works · What we send · Security posture · Data protection · FAQ · Contacts

Full overview

1. Who does what

Consumer products (Homework, Milo, Streams) follow the published policies on qwixl.com. Academy schools use the Academy pack described here.

2. How contracting works

1. 1. Discovery — signing entity (school vs trust), invoice entity, approximate numbers, preferred term, Pilot vs paid, LLM tier, AI image generation On/Off, DPO and safeguarding contacts, and whether Wonde is already in use.
2. 2. Standard pack — one Academy agreement pack (PDF). The Order Form carries parties and commercials; MSA, Product Terms, DPA, SLA, and schedules are supplier-fixed terms.
3. 3. Your review — legal, DPO, and procurement review. We answer diligence questions; we do not rewrite the product feature set per school.
4. 4. Sign and pay — completed Order Form; invoice per the Order Form.
5. 5. Go-live — tenant provisioned; Wonde connected with Required permissions; LLM tier and AI image entitlements match the Order Form.

3. What we send (and when)

At proposal / legal review (client pack):

• Cover note
• Order Form
• Master Services Agreement
• Product Terms (including Close Contacts, acceptable use, GenAI, SEN)
• Data Processing Agreement and Wonde annex
• Wonde Permissions Schedule (Required / Optional / Not requested)
• Master SLA and schedules (platform, support, Wonde sync, incidents)
• Roadmap Schedule for Planned controls (non-warranty until Implemented)
• Privacy notice templates for staff, parents, and pupils (School completes parties / DPO block before publishing locally)
• DPIA School Support Pack — so your DPO can complete your DPIA

After signature: invoice, Wonde connection instructions, and Required permissions confirmation before full functionality is promised.

On request during diligence: sub-processor list (DPA Annex III — Supabase West EU / Ireland; Vercel Dublin and London; OpenRouter EU exchange; Resend for adult transactional email only), transfer notes, and — when available under NDA — pen-test executive summary. We do not publish internal decision logs as client warranties.

4. Security posture

Production Academy runs on established cloud providers, including Vercel (application delivery in Dublin and London) and Supabase (managed Postgres in West EU / Ireland with row-level security). API access requires authenticated sessions and role checks. Data in transit uses TLS. Hosting providers supply encryption at rest for managed stores. Production AI routing uses OpenRouter’s EU exchange.

Implemented contractual technical and organisational measures are those listed as live in the Academy DPA Annex II (authentication and role checks; Close Contact controls as released; TLS; host encryption at rest; breach notification process).

Planned (explicitly non-warranty until evidenced and promoted) includes items such as automated retention enforcement with production evidence, self-serve data-subject tooling, dedicated SEN access audit logging, Cyber Essentials certification, independent penetration test with a sharable summary, and per-school Wonde credential isolation. We state these on the Roadmap Schedule for complete transparency purposes.

Report security and/or privacy concerns to support@qwixl.com.

5. Data protection

6. FAQ

Can we pick modules or turn off SEN sync? No. Academy is one standard product. Order Form options are LLM tier and AI image generation only. SEN is Required in the Wonde Permissions Schedule and is a condition of the Service. Optional Wonde categories may be declined, with related features reduced.

Will you sign our school or MAT DPA instead? We use our Academy DPA because it maps to the live product, Wonde schedule, and sub-processors. We answer diligence questions against that pack. We do not rewrite the product feature set per school.

What is the liability position? Liability is capped at twelve months’ Academy Fees. Liability the law does not allow us to limit remains uncapped. Details are in the MSA.

Do you have Cyber Essentials or a pen-test report today? Cyber Essentials and an independent pen-test summary are on our Planned controls roadmap.

What changes on a pilot? The same document pack applies. If the Order Form marks Pilot = Yes, SLA service credits do not apply.

7. Contacts and related pages

Ready for the full pack? Tell us your school or trust, DPO contact, and target go-live. After discovery, Qwixl sends a private onboarding URL to download the standard pack and submit Order Form details.

*End of Security & compliance — Qwixl Academy (public) v1.1 — 24 July 2026.*