Security & Safeguarding Assurance

Last updated: 11 September 2026

Written for a school's own compliance file – safeguarding lead, DPO, or IT – to cite when documenting due diligence on this platform (e.g. against Keeping Children Safe in Education, the DfE's filtering and monitoring standards, or the National Minimum Standards for Boarding Schools). It's a plain summary of what's actually built, not a sales page; for the underlying risk assessment and our sub-processors, see the Data Protection Impact Assessment and sub-processor register.

Who can see what

• A parent only ever sees photos tagging their own approved child – enforced at the database query level for every tenant-owned record, not left to individual pages to filter correctly.
• No pupil ever holds a direct login to the platform. Every decision and every view runs through a verified parent account or a member of school staff.
• One school's data is isolated from every other school's by the same automatic, unconditional query rule – there's no code path that can accidentally show one school's photos to another's staff.
• A full-resolution photo is never reachable until every family with a child in it has actively approved it – a single missing decision blocks it for everyone, not just that one family.

Image security

• Every uploaded photo is virus-scanned before it's processed; a scanner failure blocks the upload rather than publishing it unscanned (a fail-closed design, not fail-open).
• Location and other embedded metadata is stripped from every photo automatically on upload.
• Every photo a family can view or download carries two independent watermarks: a visible one on an unapproved preview, and an invisible, per-viewer forensic mark on every preview and download – including a staff member's own view of the original – so a leaked copy can be traced back to who accessed it.
• A photo's raw file is never handed out via a public or guessable link; every access goes through an authenticated, tenant-scoped, logged request.

Reporting a concern

• Every photo in the parent portal has a "Report a concern" option, requiring a short reason, that removes the photo for every family immediately and alerts both us and the school's own nominated safeguarding contact by email – distinct from, and faster than, an ordinary support enquiry.
• Reported photos sit in a dedicated review queue in the school's staff portal until a member of staff reinstates or permanently removes them – nothing relies solely on an email being read in time.

Account security

• Multi-factor authentication is available on every account type (parent, staff, and our own admin accounts).
• Every login is rate-limited, both per account and per network address, to slow down credential stuffing and brute-force attempts.
• New and changed passwords are checked against known-breached password lists and rejected if compromised.
• A full audit trail records every login, photo view, download, and account/data change against the account that performed it.

Data handling & retention

• All traffic is encrypted in transit; personal data fields such as email addresses are encrypted at rest, with a one-way lookup index so day-to-day operation never needs to decrypt the readable value.
• Photo retention is configurable per school and enforced automatically – photos are permanently deleted once the period lapses, with a reminder email first.
• Security and audit logs are pruned on a rolling schedule rather than kept indefinitely, in line with UK GDPR's storage-limitation principle.
• Subject access and erasure requests logged through the parent portal are tracked against a one-month statutory response deadline, visible to our team, not left to an inbox alone.

Questions?

Contact dataprotection@theschoolgallery.co.uk for data protection questions, or safeguarding@theschoolgallery.co.uk for a safeguarding concern – we're glad to walk a school's DPO or safeguarding lead through any part of this.