Schools entrust us with the most sensitive moment of the year. We treat that seriously.
MeadowFox is built to enterprise-grade security, UK data-protection standards, and the operational safeguards a school's exam office demands. Below is a plain-English summary of how we handle, host, and protect your data — and how Simon operates inside that perimeter.
UK GDPR & DPA 2018
MeadowFox operates as a data processor under UK GDPR. A Data Processing Agreement is available on request and forms part of every school contract.
UK hosting & data residency
All school data is stored within the UK. We use ISO 27001-certified infrastructure (AWS London region). No data leaves UK jurisdiction.
Encryption at rest & in transit
All data is encrypted with AES-256 at rest and TLS 1.3 in transit. Secrets and keys are stored in HSM-backed managed services.
Minimum-necessary data
MeadowFox only reviews the entry, cohort and rule data needed to run audits. Candidate-level personal data is minimised, pseudonymised where possible, and never used for model training.
Simon — controlled intelligence
Simon's reasoning runs against your data inside our perimeter only. Your data is never used to train third-party models, and we operate strict prompt & output isolation.
Auditability & signed evidence
Every audit Simon runs is logged, signed, and retained for the duration of your contract. Replayable audit history is available to governance and SLT teams.
How we operate, day to day
- Hosting region
- AWS London (eu-west-2). Data residency: United Kingdom.
- Backups
- Encrypted point-in-time backups, retained 30 days. Disaster-recovery objective: RPO < 1h, RTO < 4h.
- Access controls
- Role-based access, MFA enforced for all internal admin accounts. Least-privilege by default.
- Penetration testing
- Independent annual penetration test. Findings tracked to closure; summary letter available on request.
- Sub-processors
- Published list of sub-processors, with 14-day change notification. AI providers are contractually prevented from training on your data.
- Incident response
- 24-hour notification to affected schools on any confirmed security incident affecting their data.
- Data deletion
- Customer data is deleted within 30 days of contract end, with a signed deletion certificate provided.
- Compliance roadmap
- SOC 2 Type II in progress for 2027. Cyber Essentials Plus targeted for Q2 2027.
We'll share everything you need to do diligence properly.
Reach out and we'll send the latest Data Processing Agreement, sub-processor list, security questionnaire response, and our most recent independent pen-test summary.
The fine print, in plain English
MeadowFox Ltd, registered in England & Wales, Company No. 17312784. ICO registration: ZB-872310. Data Protection contact: dpo@meadowfox.io.