Skip to content

    The assurance pack.

    The documents your DPO, trust or council asks for before a call: download them now, no call needed.

    Updated 15 October 2026.

    What can we download?

    Every document is written for a school DPO. The DPA is the one you sign in the Sendix app; the others explain how we meet it.

    Which DPIA template is ours?

    Your school, trust or council is the controller, so it completes its own DPIA. Each template says who the controller is and who should sign, with our sections filled in.

    Who processes our pupils’ data?

    Three sub-processors, all processing in the UK. We give 30 days’ notice before adding or replacing one, and you can object.

    Microsoft Azure
    Hosting, database, backups, key management, logging
    UK South
    Amazon Bedrock (AWS)
    Runs the AI model on extracts of plan text
    London (eu-west-2)
    Amazon SES (AWS)
    Email to staff, such as invitations. No pupil data
    London (eu-west-2)

    The AI model: Qwen3-235B-A22B-2507

    Bedrock model ID qwen.qwen3-235b-a22b-2507-v1:0

    • It runs on Amazon Bedrock in AWS London using In-Region inference. We call it by its direct model ID at the London endpoint. Cross-region inference profiles, which could send a request outside the UK, are refused in our code.
    • A request is sent only if a signed approval record matches the exact endpoint, region and model. Production has one: this model, in London, in-region. Anything else is blocked.
    • Bedrock doesn’t store prompts or outputs for this model or use them for training. Nor do we: your data never trains a model.
    • It sees extracts of plan text with the pupil’s name, UPNs, NHS numbers, postcodes and dates removed, not whole plans.

    Who at Sendix can reach plan text?

    Inside the Sendix app, our administrator accounts can’t open plan text, findings, file names or pupil identifiers. The check is in the code that serves every plan, and tests in every build try it as an administrator and as staff from another school. There is no “log in as a user” feature.

    Underneath the app

    • Plan extracts are stored in a database in Azure UK South, encrypted in transit and at rest with Azure-managed keys, not with a key your school holds.
    • Two Sendix staff hold administrative access to our Azure account, with multi-factor authentication, and our deployment pipeline holds deployment rights. That access could reach the database. We don’t use it to read plan text.
    • Break-glass is used only to reset a Sendix administrator’s lost authenticator. It never reads plans.
    • Changes to our Azure resources and every database job are logged. Individual database queries are not, so if someone with this access connected to the database directly, what they read would not be recorded.

    How do we measure up to the DfE’s AI standards?

    We checked Sendix against the 63 points in the Department for Education’s Generative AI product safety standards (updated 19 January 2026): 15 met, 12 partly met, 1 not met, and 35 not applicable because pupils don’t use Sendix.

    Where we fall short

    • No published accuracy evaluation yet.
    • No recorded evaluation of the current AI model before we adopted it.
    • No written complaints procedure for safety issues.

    Each point, with what we do and the evidence, is in the self-assessment above. Read the standards on GOV.UK (opens in a new tab).

    What security checks are in place?

    Independent penetration test.
    Completed before the first school’s real pupil data goes in, covering cross-school access and the release checks. We share its summary with each school before its real plans are uploaded.
    Cyber Essentials.
    Applied for on 9 October 2026 through IASME. The assessment is under way; no certificate has been issued.
    Breach notice.
    We tell you within 24 hours of becoming aware of a personal data breach affecting your data (DPA clause 7.1).

    What if we leave, or Sendix stops?

    • Sendix never holds the only copy. We don’t keep the original file, and every amendment request and report is a file your staff download.
    • Any SENCO or SEND lead can export a plan’s data at any time. To export a pupil’s data, your staff find that pupil’s plans by reference and export each one.
    • When you leave, you choose return, deletion or both, within 30 days. Offboarding produces a deletion certificate, and backups clear within 35 days.
    • If we decide to close the service, you get at least 90 days’ notice, exports stay open throughout, and prepaid fees for the time after closure are refunded. If Sendix became insolvent, the DPA still binds whoever holds your data.

    Something missing?

    Email privacy@sendix.ai and we’ll answer in writing. Please don’t send pupil information by email.

    Book a walkthrough with your DPO (opens cal.com in a new tab)

    The short answers are on data protection. Prices are on pricing.