Data protection, answered for your DPO.

In the UK. The Sendix app, its database and its backups run in Microsoft Azure UK South. For analysis, extracts of the minimised text (not whole plans) go to an AI model on Amazon Bedrock in AWS London. Bedrock doesn’t keep the inputs or outputs for the model we use, and they aren’t used for training.

Our DPA lists the sub-processors: Microsoft Azure, AWS Bedrock and AWS SES, all processing in the UK. Suppliers may give support from outside the UK under their own terms. This website is hosted in West Europe and never handles pupil data.

No one, through the application. Plan text is visible only to your school’s SENCOs and SEND leads and your trust’s SEND lead. IT leads, billing administrators, staff at other schools and Sendix administrators can’t see it. Multi-factor authentication is mandatory for SENCO and SEND lead accounts.

Only on your school’s instructions, under a data processing agreement (DPA). Your school signs the DPA in the Sendix app and we countersign it. Real plans can be uploaded only by a school, trust or council with a countersigned DPA.

Your staff upload plans as they are: Sendix removes the pupil’s name, UPNs, NHS numbers, postcodes and dates before the text is stored. The walkthrough and the free check use fictional plans.

Nothing goes to families from Sendix. It’s a tool for school staff: its emails go to staff, and its drafts and exports go to the staff who use them. Any change to an EHCP goes through the council, which consults the family before amending the plan.

Your school is the controller, so your own privacy notice tells families how their information is used.

Yes, for Scottish IEPs. It checks each target against Education Scotland’s IEP guidance and suggests measurable wording built only from the plan, leaving gaps for your team. See a worked example on the IEP review page.

Because we’re adding organisations carefully, a few at a time, so each one gets close support. During the pilot your staff check every finding, and we report how many were right.

During it, a daily job deletes records when your retention period ends. At the end of the contract you choose whether we return your data in a commonly used format, delete it, or both. We do that within 30 days and confirm deletion in writing, unless the law requires us to keep it. Deleted records leave our encrypted backups, which stay in UK South, within 35 days.